CVE-2023-31326

Summary

Use of an uninitialized variable in the ASP could allow an attacker to access leftover data from a trusted execution environment (TEE) driver, potentially leading to loss of confidentiality.

Affected Software

VendorProductVersion RangeStatus
AMDAMD Ryzen™ 5000 Series Mobile Processors with Radeon™ GraphicsCezanne-FP6_1.0.1.0unaffected
AMDAMD Ryzen™ 7030 Series Mobile processors with Radeon™ GraphicsCezanne-FP6_1.0.1.0unaffected
AMDAMD Ryzen™ 4000 Series Desktop ProcessorsComboAM4v2PI_1.2.0.CAunaffected
AMDAMD Ryzen™ 5000 Series Desktop ProcessorsComboAM4v2PI_1.2.0.CAunaffected
AMDAMD Ryzen™ 7040 Series Mobile Processors with Radeon™ GraphicsPhoenixPI-FP8-FP7_1.1.0.2unaffected
AMDAMD Ryzen™ 4000 Series Mobile Processors with Radeon™ GraphicsRenoir-FP6_ 1.0.0.Dunaffected
AMDAMD Ryzen™ 6000 Series Processors with Radeon™ GraphicsRembrandt-FP7_1.0.0.Aunaffected
AMDAMD Ryzen™ 5000 Series Mobile Processors with Radeon™ GraphicsCezanne-FP6_1.0.1.0unaffected
AMDAMD Ryzen™ 7020 Series Processors with Radeon™ GraphicsMendocinoPI-FT6_1.0.0.6unaffected
AMDAMD Ryzen™ Embedded V2000 Series ProcessorsEmbeddedPI-FP6_1.0.0.Aunaffected
AMDAMD Ryzen™ Embedded V3000 Series ProcessorsEmbedded-PI_FP7r2 1009unaffected
AMDAMD Radeon™ RX 7000 Series Graphics ProductsAMD Software: Adrenalin Edition 24.7.1 (24.10.29.01)unaffected
AMDAMD Radeon™ PRO W7000 Series Graphics ProductsAMD Software: PRO Edition 24.Q2 (24.10.20)unaffected
AMDAMD Instinct™ MI210ROCm 6.4unaffected
AMDAMD Instinct™ MI250ROCm 6.4unaffected
AMDAMD Radeon™ PRO V710 Graphics ProductsContact your AMD Customer Engineering representativeunaffected

Weaknesses

  • CWE-457: CWE-457 Use of Uninitialized Variable

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References