CVE-2023-20521

published 2023-11-14

CVE-2023-20521: TOCTOU in the ASP Bootloader may allow an attacker with physical access to tamper with SPI ROM records after memory content verification, potentially leading…

Priority P4 22 medium 5.7 CVSS 3.1

AV P AC H PR N UI N S U C H I N A H

TOCTOU in the ASP Bootloader may allow an attacker with physical access to tamper with SPI ROM records after memory content verification, potentially leading to loss of confidentiality or a denial of service.

Affected

103 ranges · showing 25

Vendor	Product	Version range	Fixed in
amd	1st_gen_amd_epyc_processors	—	—
amd	2nd_gen_amd_epyc_processors	—	—
amd	3rd_gen_amd_epyc_processors	—	—
amd	amd_3015ce_firmware	< pollockpi-ft5_1.0.0.4	pollockpi-ft5_1.0.0.4
amd	amd_3015e_firmware	< pollockpi-ft5_1.0.0.4	pollockpi-ft5_1.0.0.4
amd	amd_epyc_embedded_3000	—	—
amd	amd_epyc_embedded_7002	—	—
amd	amd_epyc_embedded_7003	—	—
amd	amd_ryzen_embedded_r1000	—	—
amd	amd_ryzen_embedded_r2000	—	—
amd	amd_ryzen_embedded_v1000	—	—
amd	athlon_3000_series_desktop_processors_with_radeon_graphics_picasso_am4	—	—
amd	athlon_3000_series_mobile_processors_with_radeon_graphics_dali_dali_fp5	—	—
amd	athlon_3000_series_mobile_processors_with_radeon_graphics_pollock	—	—
amd	epyc_7001_firmware	< naplespi_1.0.0.h	naplespi_1.0.0.h
amd	epyc_7203_firmware	< milanpi_1.0.0.7	milanpi_1.0.0.7
amd	epyc_7203p_firmware	< milanpi_1.0.0.7	milanpi_1.0.0.7
amd	epyc_7232p_firmware	< romepi_1.0.0.d	romepi_1.0.0.d
amd	epyc_7251_firmware	< naplespi_1.0.0.h	naplespi_1.0.0.h
amd	epyc_7252_firmware	< romepi_1.0.0.d	romepi_1.0.0.d
amd	epyc_7261_firmware	< naplespi_1.0.0.h	naplespi_1.0.0.h
amd	epyc_7262_firmware	< romepi_1.0.0.d	romepi_1.0.0.d
amd	epyc_7272_firmware	< romepi_1.0.0.d	romepi_1.0.0.d
amd	epyc_7281_firmware	< naplespi_1.0.0.h	naplespi_1.0.0.h
amd	epyc_7282_firmware	< romepi_1.0.0.d	romepi_1.0.0.d

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-367