CVE-2023-20577
7.4
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
A heap overflow in SMM module may allow an attacker with access to a second vulnerability that enables writing to SPI flash, potentially resulting in arbitrary code execution.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| AMD | 2nd Gen AMD EPYC™ Processors | RomePI 1.0.0.H | unaffected |
| AMD | 3rd Gen AMD EPYC™ Processors | MilanPI 1.0.0.C | unaffected |
| AMD | 4th Gen AMD EPYC™ Processors | GenoaPI 1.0.0.8 | unaffected |
| AMD | AMD Instinct™ MI300A | MI300 SR5 PI 1.0.0.1 | unaffected |
| AMD | AMD Ryzen™ 3000 Series Desktop Processors | ComboAM4v2 1.2.0.B | unaffected |
| AMD | AMD Ryzen™ 3000 Series Desktop Processors | ComboAM4 1.0.0.B | unaffected |
| AMD | AMD Ryzen™ 5000 Series Desktop Processors | ComboAM4v2 1.2.0.B | unaffected |
| AMD | AMD Ryzen™ 5000 Series Desktop Processors with Radeon™ Graphics | ComboAM4v2 1.2.0.B | unaffected |
| AMD | AMD Ryzen™ 7000 Series Processors | ComboAM5 1.0.0.7b | unaffected |
| AMD | AMD Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics | ComboAM4v2 1.2.0.B | unaffected |
| AMD | AMD Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics | ComboAM4 1.0.0.B | unaffected |
| AMD | AMD Ryzen™ 4000 Series Desktop Processors with Radeon™ Graphics | ComboAM4v2 1.2.0.B | unaffected |
| AMD | AMD Ryzen™ Threadripper™ 3000 Series Processors | CastlePeakPI-SP3r3 1.0.0.A | unaffected |
| AMD | AMD Ryzen™ Threadripper™ PRO 3000WX Series Processors | ChagallWSPI-sWRX8 1.0.0.7 | unaffected |
| AMD | AMD Ryzen™ Threadripper™ PRO 3000WX Series Processors | CastlePeakWSPI-sWRX8 1.0.0.C | unaffected |
| AMD | AMD Ryzen™ Threadripper™ PRO 5000WX Processors | ChagallWSPI-sWRX8 1.0.0.7 | unaffected |
| AMD | AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics | PicassoPI-FP5 1.0.1.0 | unaffected |
| AMD | AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics | PollockPI-FT5 1.0.0.6 | unaffected |
| AMD | AMD Ryzen™ 3000 Series Mobile Processor with Radeon™ Graphics | PicassoPI-FP5 1.0.1.0 | unaffected |
| AMD | AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics | RenoirPI-FP6 1.0.0.D | unaffected |
| AMD | AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics | CezannePI-FP6 1.0.0.F | unaffected |
| AMD | AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics | CezannePI-FP6 1.0.0.F | unaffected |
| AMD | AMD Ryzen™ 7020 Series Processors with Radeon™ Graphics | MendocinoPI-FT6 1.0.0.6 | unaffected |
| AMD | AMD Ryzen™ 6000 Series Processors with Radeon™ Graphics | RembrandtPI-FP7 1.0.0.9b | unaffected |
| AMD | AMD Ryzen™ 7035 Series Processors with Radeon™ Graphics | RembrandtPI-FP7 1.0.0.9b | unaffected |
| AMD | AMD Ryzen™ 5000 Series Processors with Radeon™ Graphics | CezannePI-FP6 1.0.0.F | unaffected |
| AMD | AMD Ryzen™ 3000 Series Processors with Radeon™ Graphics | CezannePI-FP6 1.0.0.F | unaffected |
| AMD | AMD Ryzen™ 7040 Series Processors with Radeon™ Graphics | PhoenixPI-FP8-FP7 1.0.0.2 | unaffected |
| AMD | AMD Ryzen™ 7045 Series Mobile Processors | DragonRangeFL1PI 1.0.0.3a | unaffected |
| AMD | AMD EPYC™ Embedded 3000 | Snowyowl PI 1.1.0.B | unaffected |
| AMD | AMD EPYC™ Embedded 7002 | EmbRomePI-SP3 1.0.0.B | unaffected |
| AMD | AMD EPYC™ Embedded 7003 | EmbMilanPI-SP3 1.0.0.8 | unaffected |
| AMD | AMD EPYC™ Embedded 9003 | EmbGenoaPI-SP5 1.0.0.3 | unaffected |
| AMD | AMD Ryzen™ Embedded R1000 | EmbeddedPI-FP5 1.2.0.A | unaffected |
| AMD | AMD Ryzen™ Embedded R2000 | EmbeddedPI-FP5 1.0.0.2 | unaffected |
| AMD | AMD Ryzen™ Embedded 5000 | EmbAM4PI 1.0.0.4 | unaffected |
| AMD | AMD Ryzen™ Embedded V1000 | EmbeddedPI-FP5 1.2.0.A | unaffected |
| AMD | AMD Ryzen™ Embedded V2000 | EmbeddedPI-FP6 1.0.0.9 | unaffected |
| AMD | AMD Ryzen™ Embedded V3000 | EmbeddedPI-FP7r2 1.0.0.8 | unaffected |
Weaknesses
- CWE-121: CWE-121 Stack-based buffer overflow
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.