CVE-2023-20527

CWE-20 — Improper Input Validation3 documents3 sources
Severity
6.5MEDIUM
EPSS
0.3%
top 46.37%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
67
AMD Epyc 7001 FirmwareAMD Epyc 7002 FirmwareAMD Epyc 7003 Firmware+64 more
Timeline
PublishedJan 11

Description

Improper syscall input validation in the ASP Bootloader may allow a privileged attacker to read memory out-of-bounds, potentially leading to a denial-of-service.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages67 packages

▶NVDamd/epyc_7001_firmware< naplespi_1.0.0.g
▶NVDamd/epyc_7002_firmware< romepi_1.0.0.c
▶NVDamd/epyc_7003_firmware< milanpi_1.0.0.5
▶NVDamd/epyc_7251_firmware< naplespi_1.0.0.g
▶NVDamd/epyc_7252_firmware< romepi_1.0.0.c

🔴Vulnerability Details

2
GHSA
GHSA-fg26-2429-pm48: Improper syscall input validation in the ASP Bootloader may allow a privileged attacker to read memory out-of-bounds, potentially leading to a denial-↗2023-01-11
▶
CVEList
CVE-2023-20527: Improper syscall input validation in the ASP Bootloader may allow a privileged attacker to read memory out-of-bounds, potentially leading to a denial-↗2023-01-10
▶
CVE-2023-20527 (MEDIUM CVSS 6.5) | Improper syscall input validation i | cvebase.io