CVE-2023-20577

Summary

A heap overflow in SMM module may allow an attacker with access to a second vulnerability that enables writing to SPI flash, potentially resulting in arbitrary code execution.

Affected Software

VendorProductVersion RangeStatus
AMD2nd Gen AMD EPYC™ ProcessorsRomePI 1.0.0.Hunaffected
AMD3rd Gen AMD EPYC™ ProcessorsMilanPI 1.0.0.Cunaffected
AMD4th Gen AMD EPYC™ ProcessorsGenoaPI 1.0.0.8unaffected
AMDAMD Instinct™ MI300AMI300 SR5 PI 1.0.0.1unaffected
AMDAMD Ryzen™ 3000 Series Desktop ProcessorsComboAM4v2 1.2.0.Bunaffected
AMDAMD Ryzen™ 3000 Series Desktop ProcessorsComboAM4 1.0.0.Bunaffected
AMDAMD Ryzen™ 5000 Series Desktop ProcessorsComboAM4v2 1.2.0.Bunaffected
AMDAMD Ryzen™ 5000 Series Desktop Processors with Radeon™ GraphicsComboAM4v2 1.2.0.Bunaffected
AMDAMD Ryzen™ 7000 Series ProcessorsComboAM5 1.0.0.7bunaffected
AMDAMD Athlon™ 3000 Series Desktop Processors with Radeon™ GraphicsComboAM4v2 1.2.0.Bunaffected
AMDAMD Athlon™ 3000 Series Desktop Processors with Radeon™ GraphicsComboAM4 1.0.0.Bunaffected
AMDAMD Ryzen™ 4000 Series Desktop Processors with Radeon™ GraphicsComboAM4v2 1.2.0.Bunaffected
AMDAMD Ryzen™ Threadripper™ 3000 Series ProcessorsCastlePeakPI-SP3r3 1.0.0.Aunaffected
AMDAMD Ryzen™ Threadripper™ PRO 3000WX Series ProcessorsChagallWSPI-sWRX8 1.0.0.7unaffected
AMDAMD Ryzen™ Threadripper™ PRO 3000WX Series ProcessorsCastlePeakWSPI-sWRX8 1.0.0.Cunaffected
AMDAMD Ryzen™ Threadripper™ PRO 5000WX ProcessorsChagallWSPI-sWRX8 1.0.0.7unaffected
AMDAMD Athlon™ 3000 Series Mobile Processors with Radeon™ GraphicsPicassoPI-FP5 1.0.1.0unaffected
AMDAMD Athlon™ 3000 Series Mobile Processors with Radeon™ GraphicsPollockPI-FT5 1.0.0.6unaffected
AMDAMD Ryzen™ 3000 Series Mobile Processor with Radeon™ GraphicsPicassoPI-FP5 1.0.1.0unaffected
AMDAMD Ryzen™ 4000 Series Mobile Processors with Radeon™ GraphicsRenoirPI-FP6 1.0.0.Dunaffected
AMDAMD Ryzen™ 5000 Series Mobile Processors with Radeon™ GraphicsCezannePI-FP6 1.0.0.Funaffected
AMDAMD Ryzen™ 5000 Series Mobile Processors with Radeon™ GraphicsCezannePI-FP6 1.0.0.Funaffected
AMDAMD Ryzen™ 7020 Series Processors with Radeon™ GraphicsMendocinoPI-FT6 1.0.0.6unaffected
AMDAMD Ryzen™ 6000 Series Processors with Radeon™ GraphicsRembrandtPI-FP7 1.0.0.9bunaffected
AMDAMD Ryzen™ 7035 Series Processors with Radeon™ GraphicsRembrandtPI-FP7 1.0.0.9bunaffected
AMDAMD Ryzen™ 5000 Series Processors with Radeon™ GraphicsCezannePI-FP6 1.0.0.Funaffected
AMDAMD Ryzen™ 3000 Series Processors with Radeon™ GraphicsCezannePI-FP6 1.0.0.Funaffected
AMDAMD Ryzen™ 7040 Series Processors with Radeon™ GraphicsPhoenixPI-FP8-FP7 1.0.0.2unaffected
AMDAMD Ryzen™ 7045 Series Mobile ProcessorsDragonRangeFL1PI 1.0.0.3aunaffected
AMDAMD EPYC™ Embedded 3000Snowyowl PI 1.1.0.Bunaffected
AMDAMD EPYC™ Embedded 7002EmbRomePI-SP3 1.0.0.Bunaffected
AMDAMD EPYC™ Embedded 7003EmbMilanPI-SP3 1.0.0.8unaffected
AMDAMD EPYC™ Embedded 9003EmbGenoaPI-SP5 1.0.0.3unaffected
AMDAMD Ryzen™ Embedded R1000EmbeddedPI-FP5 1.2.0.Aunaffected
AMDAMD Ryzen™ Embedded R2000EmbeddedPI-FP5 1.0.0.2unaffected
AMDAMD Ryzen™ Embedded 5000EmbAM4PI 1.0.0.4unaffected
AMDAMD Ryzen™ Embedded V1000EmbeddedPI-FP5 1.2.0.Aunaffected
AMDAMD Ryzen™ Embedded V2000EmbeddedPI-FP6 1.0.0.9unaffected
AMDAMD Ryzen™ Embedded V3000EmbeddedPI-FP7r2 1.0.0.8unaffected

Weaknesses

  • CWE-121: CWE-121 Stack-based buffer overflow

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References