CVE-2023-20521

published 2023-11-14

CVE-2023-20521: TOCTOU in the ASP Bootloader may allow an attacker with physical access to tamper with SPI ROM records after memory content verification, potentially leading…

medium 5.7 CVSS 3.1

AV P AC H PR N UI N S U C H I N A H

TOCTOU in the ASP Bootloader may allow an attacker with physical access to tamper with SPI ROM records after memory content verification, potentially leading to loss of confidentiality or a denial of service.

Affected

103 ranges · showing 25

Vendor	Product	Version range	Fixed in
amd	1st_gen_amd_epyc_processors	—	—
amd	2nd_gen_amd_epyc_processors	—	—
amd	3rd_gen_amd_epyc_processors	—	—
amd	amd_3015ce_firmware	< pollockpi-ft5_1.0.0.4	pollockpi-ft5_1.0.0.4
amd	amd_3015e_firmware	< pollockpi-ft5_1.0.0.4	pollockpi-ft5_1.0.0.4
amd	amd_epyc_embedded_3000	—	—
amd	amd_epyc_embedded_7002	—	—
amd	amd_epyc_embedded_7003	—	—
amd	amd_ryzen_embedded_r1000	—	—
amd	amd_ryzen_embedded_r2000	—	—
amd	amd_ryzen_embedded_v1000	—	—
amd	athlon_3000_series_desktop_processors_with_radeon_graphics_picasso_am4	—	—
amd	athlon_3000_series_mobile_processors_with_radeon_graphics_dali_dali_fp5	—	—
amd	athlon_3000_series_mobile_processors_with_radeon_graphics_pollock	—	—
amd	epyc_7001_firmware	< naplespi_1.0.0.h	naplespi_1.0.0.h
amd	epyc_7203_firmware	< milanpi_1.0.0.7	milanpi_1.0.0.7
amd	epyc_7203p_firmware	< milanpi_1.0.0.7	milanpi_1.0.0.7
amd	epyc_7232p_firmware	< romepi_1.0.0.d	romepi_1.0.0.d
amd	epyc_7251_firmware	< naplespi_1.0.0.h	naplespi_1.0.0.h
amd	epyc_7252_firmware	< romepi_1.0.0.d	romepi_1.0.0.d
amd	epyc_7261_firmware	< naplespi_1.0.0.h	naplespi_1.0.0.h
amd	epyc_7262_firmware	< romepi_1.0.0.d	romepi_1.0.0.d
amd	epyc_7272_firmware	< romepi_1.0.0.d	romepi_1.0.0.d
amd	epyc_7281_firmware	< naplespi_1.0.0.h	naplespi_1.0.0.h
amd	epyc_7282_firmware	< romepi_1.0.0.d	romepi_1.0.0.d

CWE-367