Vulnerability-Lookup

BDU:2024-00339

Vulnerability from fstec - Published: 14.11.2023

Title

Уязвимость реализации режима управления системой System Management Mode (SMM) микропрограммного обеспечения процессоров AMD, позволяющая нарушителю выполнить произвольный код

Description

Уязвимость реализации режима управления системой System Management Mode (SMM) микропрограммного обеспечения процессоров AMD связана с недостаточной проверкой входных данных. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, выполнить произвольный код

Severity ?


                    
                      AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vendor

Advanced Micro Devices Inc.

Software Name

3rd Gen AMD EPYC, AMD Athlon 3000 Series Mobile Processors with Radeon Graphics Pollock, AMD Athlon 3000 Series Desktop Processors with Radeon Graphics Picasso, AMD Ryzen Threadripper 3000 Series Processors, AMD Ryzen Threadripper PRO 3000WX Series Processors, AMD Athlon Mobile processor with Radeon graphics, AMD Ryzen Threadripper 2000 Series Processors, AMD Ryzen 3000 Series Desktop Processors Matisse AM4, AMD Ryzen 5000 Series Desktop Processors Vermeer AM4, AMD Ryzen 5000 Series Mobile Processors with Radeon Graphics Cezanne, AMD Ryzen 3000 Series Mobile Processors with Radeon Graphics Picasso, AMD Ryzen Threadripper PRO processors, AMD Ryzen 4000 Series Desktop Processors with Radeon Graphics Renoir FP5, AMD Ryzen 6000 Series Mobile Processors Rembrandt, AMD Ryzen 7035 Series Processors with Radeon Graphics, AMD Ryzen 5000 Series Processors with Radeon Graphics Barcelo, AMD Ryzen 7030 Series Mobile Processors Barcelo, AMD Ryzen 5000 Series Mobile Processors with Radeon Graphics Lucienne

Software Version

до MilanPI 1.0.0.3 (3rd Gen AMD EPYC), до PollockPI-FT5 1.0.0.5 (AMD Athlon 3000 Series Mobile Processors with Radeon Graphics Pollock), до ComboAM4PI 1.0.0.9 (AMD Athlon 3000 Series Desktop Processors with Radeon Graphics Picasso), до ComboAM4v2 PI 1.2.0.8 (AMD Athlon 3000 Series Desktop Processors with Radeon Graphics Picasso), до CastlePeakPI-SP3r3 1.0.0.8 (AMD Ryzen Threadripper 3000 Series Processors), до ChagallWSPI 1.0.0.3 (AMD Ryzen Threadripper PRO 3000WX Series Processors), до PollockPI-FT5 1.0.0.5 (AMD Athlon Mobile processor with Radeon graphics), до SummitPI-SP3r2 1.1.0.6 (AMD Ryzen Threadripper 2000 Series Processors), до ComboAM4PI 1.0.0.9 (AMD Ryzen 3000 Series Desktop Processors Matisse AM4), до ComboAM4v2 PI 1.2.0.8 (AMD Ryzen 3000 Series Desktop Processors Matisse AM4), до ComboAM4 V2 PI 1.2.0.8 (AMD Ryzen 5000 Series Desktop Processors Vermeer AM4), до ComboAM4v2 PI 1.2.0.8 (AMD Ryzen 5000 Series Mobile Processors with Radeon Graphics Cezanne), до ComboAM4PI 1.0.0.9 (AMD Ryzen 3000 Series Mobile Processors with Radeon Graphics Picasso), до ComboAM4v2 PI 1.2.0.8 (AMD Ryzen 3000 Series Mobile Processors with Radeon Graphics Picasso), до CastlePeakWSPI-sWRX8 1.0.0.A (AMD Ryzen Threadripper PRO processors), до ChagallWSPI 1.0.0.3 (AMD Ryzen Threadripper PRO processors), до PicassoPI-FP5 1.0.0.E (AMD Ryzen 3000 Series Mobile Processors with Radeon Graphics Picasso), до RenoirPI-FP6 1.0.0.9 (AMD Ryzen 4000 Series Desktop Processors with Radeon Graphics Renoir FP5), до ComboAM4v2 PI 1.2.0.8 (AMD Ryzen 4000 Series Desktop Processors with Radeon Graphics Renoir FP5), до CezannePI-FP6 1.0.0.B (AMD Ryzen 5000 Series Mobile Processors with Radeon Graphics Cezanne), до RembrandtPI-FP7 1.0.0.2 (AMD Ryzen 6000 Series Mobile Processors Rembrandt), до RembrandtPI-FP7 1.0.0.2 (AMD Ryzen 7035 Series Processors with Radeon Graphics), до CezannePI-FP6 1.0.0.B (AMD Ryzen 5000 Series Processors with Radeon Graphics Barcelo), до CezannePI-FP6 1.0.0.B (AMD Ryzen 7030 Series Mobile Processors Barcelo), до CezannePI-FP6 1.0.0.B (AMD Ryzen 5000 Series Mobile Processors with Radeon Graphics Lucienne)

Possible Mitigations

Использование рекомендаций производителя: https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-3002 https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-4002

Reference

https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-3002 https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-4002

CWE

CWE-20

JSON

To clipboard

{
  "CVSS 2.0": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
  "CVSS 3.0": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Advanced Micro Devices Inc.",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "\u0434\u043e MilanPI 1.0.0.3 (3rd Gen AMD EPYC), \u0434\u043e PollockPI-FT5 1.0.0.5 (AMD Athlon 3000 Series Mobile Processors with Radeon Graphics Pollock), \u0434\u043e ComboAM4PI 1.0.0.9 (AMD Athlon 3000 Series Desktop Processors with Radeon Graphics Picasso), \u0434\u043e ComboAM4v2 PI 1.2.0.8 (AMD Athlon 3000 Series Desktop Processors with Radeon Graphics Picasso), \u0434\u043e CastlePeakPI-SP3r3 1.0.0.8 (AMD Ryzen Threadripper 3000 Series Processors), \u0434\u043e ChagallWSPI 1.0.0.3 (AMD Ryzen Threadripper PRO 3000WX Series Processors), \u0434\u043e PollockPI-FT5 1.0.0.5 (AMD Athlon Mobile processor with Radeon graphics), \u0434\u043e SummitPI-SP3r2 1.1.0.6 (AMD Ryzen Threadripper 2000 Series Processors), \u0434\u043e ComboAM4PI 1.0.0.9 (AMD Ryzen 3000 Series Desktop Processors Matisse AM4), \u0434\u043e ComboAM4v2 PI 1.2.0.8 (AMD Ryzen 3000 Series Desktop Processors Matisse AM4), \u0434\u043e ComboAM4 V2 PI 1.2.0.8 (AMD Ryzen 5000 Series Desktop Processors Vermeer AM4), \u0434\u043e ComboAM4v2 PI 1.2.0.8 (AMD Ryzen 5000 Series Mobile Processors with Radeon Graphics Cezanne), \u0434\u043e ComboAM4PI 1.0.0.9 (AMD Ryzen 3000 Series Mobile Processors with Radeon Graphics Picasso), \u0434\u043e ComboAM4v2 PI 1.2.0.8 (AMD Ryzen 3000 Series Mobile Processors with Radeon Graphics Picasso), \u0434\u043e CastlePeakWSPI-sWRX8 1.0.0.A (AMD Ryzen Threadripper PRO processors), \u0434\u043e ChagallWSPI 1.0.0.3 (AMD Ryzen Threadripper PRO processors), \u0434\u043e PicassoPI-FP5 1.0.0.E (AMD Ryzen 3000 Series Mobile Processors with Radeon Graphics Picasso), \u0434\u043e RenoirPI-FP6 1.0.0.9 (AMD Ryzen 4000 Series Desktop Processors with Radeon Graphics Renoir FP5), \u0434\u043e ComboAM4v2 PI 1.2.0.8 (AMD Ryzen 4000 Series Desktop Processors with Radeon Graphics Renoir FP5), \u0434\u043e CezannePI-FP6 1.0.0.B (AMD Ryzen 5000 Series Mobile Processors with Radeon Graphics Cezanne), \u0434\u043e RembrandtPI-FP7 1.0.0.2 (AMD Ryzen 6000 Series Mobile Processors Rembrandt), \u0434\u043e RembrandtPI-FP7 1.0.0.2 (AMD Ryzen 7035 Series Processors with Radeon Graphics), \u0434\u043e CezannePI-FP6 1.0.0.B (AMD Ryzen 5000 Series Processors with Radeon Graphics Barcelo), \u0434\u043e CezannePI-FP6 1.0.0.B (AMD Ryzen 7030 Series Mobile Processors Barcelo), \u0434\u043e CezannePI-FP6 1.0.0.B (AMD Ryzen 5000 Series Mobile Processors with Radeon Graphics Lucienne)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\nhttps://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-3002\t \nhttps://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-4002",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "14.11.2023",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "17.01.2024",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "17.01.2024",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2024-00339",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2022-23820",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "3rd Gen AMD EPYC, AMD Athlon 3000 Series Mobile Processors with Radeon Graphics Pollock, AMD Athlon 3000 Series Desktop Processors with Radeon Graphics Picasso, AMD Ryzen Threadripper 3000 Series Processors, AMD Ryzen Threadripper PRO 3000WX Series Processors, AMD Athlon Mobile processor with Radeon graphics, AMD Ryzen Threadripper 2000 Series Processors, AMD Ryzen 3000 Series Desktop Processors Matisse AM4, AMD Ryzen 5000 Series Desktop Processors Vermeer AM4, AMD Ryzen 5000 Series Mobile Processors with Radeon Graphics Cezanne, AMD Ryzen 3000 Series Mobile Processors with Radeon Graphics Picasso, AMD Ryzen Threadripper PRO processors, AMD Ryzen 4000 Series Desktop Processors with Radeon Graphics Renoir FP5, AMD Ryzen 6000 Series Mobile Processors Rembrandt, AMD Ryzen 7035 Series Processors with Radeon Graphics, AMD Ryzen 5000 Series Processors with Radeon Graphics Barcelo, AMD Ryzen 7030 Series Mobile Processors Barcelo, AMD Ryzen 5000 Series Mobile Processors with Radeon Graphics Lucienne",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0440\u0435\u0436\u0438\u043c\u0430 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u043e\u0439 System Management Mode (SMM) \u043c\u0438\u043a\u0440\u043e\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u043e\u0432 AMD, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u0430\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u0432\u0432\u043e\u0434\u0438\u043c\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 (CWE-20)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0440\u0435\u0436\u0438\u043c\u0430 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u043e\u0439 System Management Mode (SMM) \u043c\u0438\u043a\u0440\u043e\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u043e\u0432 AMD \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u043e\u0439 \u0432\u0445\u043e\u0434\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u0441\u0443\u0440\u0441\u0430\u043c\u0438",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-3002\t \nhttps://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-4002",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041c\u0438\u043a\u0440\u043e\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0439 \u043a\u043e\u0434 \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u044b\u0445 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430, \u041c\u0438\u043a\u0440\u043e\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0439 \u043a\u043e\u0434",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-20",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 10)\n\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 9,8)"
}

CVE-2022-23820 (GCVE-0-2022-23820)

Vulnerability from cvelistv5 – Published: 2023-11-14 18:52 – Updated: 2024-08-03 03:51

Summary

Failure to validate the AMD SMM communication buffer may allow an attacker to corrupt the SMRAM potentially leading to arbitrary code execution.

Severity ?

7.5 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Assigner

AMD

References

URL

Tags

	https://www.amd.com/en/corporate/product-security…	vendor-advisory
	https://www.amd.com/en/corporate/product-security…	vendor-advisory
	https://www.amd.com/en/corporate/product-security…	vendor-advisory

Impacted products

Vendor

Product

Version

AMD

Ryzen™ 3000 series Desktop Processors “Matisse"

Affected: various

AMD	AMD Ryzen™ 5000 Series Desktop Processors “Vermeer”	Affected: various
AMD	AMD Ryzen™ 5000 Series Desktop Processor with Radeon™ Graphics “Cezanne”	Affected: various
AMD	AMD Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics “Picasso” AM4	Affected: various
AMD	AMD Ryzen™ Threadripper™ 2000 Series Processors “Colfax”	Affected: Various
AMD	AMD Ryzen™ Threadripper™ 3000 Series Processors “Castle Peak” HEDT	Affected: various
AMD	AMD Ryzen™ Threadripper™ PRO Processors “Castle Peak” WS SP3	Affected: various
AMD	AMD Ryzen™ Threadripper™ PRO 3000WX Series Processors “Chagall” WS	Affected: various
AMD	AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics “Pollock”	Affected: various
AMD	AMD Ryzen™ 3000 Series Mobile Processor with Radeon™ Graphics “Picasso” FP5	Affected: various
AMD	AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics “Renoir” FP6	Affected: various
AMD	AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics “Lucienne”	Affected: various
AMD	AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics “Cezanne”	Affected: various
AMD	AMD Ryzen™ 6000 Series Processors with Radeon™ Graphics "Rembrandt"	Affected: various
AMD	AMD Ryzen™ 7035 Series Processors with Radeon™ Graphics “Rembrandt-R”	Affected: various
AMD	AMD Ryzen™ 5000 Series Processors with Radeon™ Graphics “Barcelo”	Affected: various
AMD	AMD Ryzen™ 7030 Series Mobile Processors with Radeon™ Graphics “Barcelo-R”	Affected: various
AMD	3rd Gen AMD EPYC™ Processors	Affected: various
AMD	AMD EPYC™ Embedded 7003	Affected: various
AMD	AMD EPYC™ Embedded 7003	Affected: various

Date Public ?

2023-11-14 17:30

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T03:51:46.067Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-4002"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-3002"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-5001"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "Ryzen\u2122 3000 series Desktop Processors \u201cMatisse\"",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "AMD Ryzen\u2122 5000 Series Desktop Processors \u201cVermeer\u201d",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "AMD Ryzen\u2122 5000 Series Desktop Processor with Radeon\u2122 Graphics  \u201cCezanne\u201d",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "AMD Athlon\u2122 3000 Series Desktop Processors with Radeon\u2122 Graphics \u201cPicasso\u201d AM4",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "AMD Ryzen\u2122 Threadripper\u2122 2000 Series Processors \u201cColfax\u201d",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "Various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "AMD Ryzen\u2122 Threadripper\u2122 3000 Series Processors \u201cCastle Peak\u201d HEDT",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "AMD Ryzen\u2122 Threadripper\u2122 PRO Processors \u201cCastle Peak\u201d WS SP3",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "AMD Ryzen\u2122 Threadripper\u2122 PRO 3000WX Series Processors  \u201cChagall\u201d WS",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "AMD Athlon\u2122 3000 Series Mobile Processors with Radeon\u2122 Graphics   \u201cPollock\u201d",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "AMD Ryzen\u2122 3000 Series Mobile Processor with Radeon\u2122 Graphics \u201cPicasso\u201d FP5",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "AMD Ryzen\u2122 4000 Series Mobile Processors with Radeon\u2122 Graphics \u201cRenoir\u201d FP6",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "AMD Ryzen\u2122 5000 Series Mobile Processors with Radeon\u2122 Graphics \u201cLucienne\u201d",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "AMD Ryzen\u2122 5000 Series Mobile Processors with Radeon\u2122 Graphics \u201cCezanne\u201d",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "AMD Ryzen\u2122 6000 Series Processors with Radeon\u2122 Graphics \"Rembrandt\"",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "AMD Ryzen\u2122 7035 Series Processors with Radeon\u2122 Graphics \u201cRembrandt-R\u201d",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "AMD Ryzen\u2122 5000 Series Processors with Radeon\u2122 Graphics  \u201cBarcelo\u201d",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "AMD Ryzen\u2122 7030 Series Mobile Processors with Radeon\u2122 Graphics \u201cBarcelo-R\u201d",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "3rd Gen AMD EPYC\u2122 Processors",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "AMD EPYC\u2122 Embedded 7003",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "AMD EPYC\u2122 Embedded 7003",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        }
      ],
      "datePublic": "2023-11-14T17:30:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Failure to validate the AMD SMM communication buffer\nmay allow an attacker to corrupt the SMRAM potentially leading to arbitrary\ncode execution.\n\n\n\n\n\n\n\n\u003cbr\u003e"
            }
          ],
          "value": "Failure to validate the AMD SMM communication buffer\nmay allow an attacker to corrupt the SMRAM potentially leading to arbitrary\ncode execution."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-18T18:28:41.324Z",
        "orgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
        "shortName": "AMD"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-4002"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-3002"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-5001"
        }
      ],
      "source": {
        "advisory": "AMD-SB-4002, AMD-SB-3002, AMD-SB-5001",
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
    "assignerShortName": "AMD",
    "cveId": "CVE-2022-23820",
    "datePublished": "2023-11-14T18:52:21.457Z",
    "dateReserved": "2022-01-21T17:20:55.778Z",
    "dateUpdated": "2024-08-03T03:51:46.067Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

BDU:2024-00339

CVE-2022-23820 (GCVE-0-2022-23820)

Tags

Sightings

Nomenclature