CVE-2023-20555

CWE-787 — Out-of-bounds Write4 documents4 sources
Severity
7.8HIGH
EPSS
0.0%
top 87.46%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
134
AMD Athlon 3015ce FirmwareAMD Athlon 3015e FirmwareAMD Athlon Gold 3150c Firmware+131 more
Timeline
PublishedAug 8

Description

Insufficient input validation in CpmDisplayFeatureSmm may allow an attacker to corrupt SMM memory by overwriting an arbitrary bit in an attacker-controlled pointer potentially leading to arbitrary code execution in SMM.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages134 packages

▶NVDamd/ryzen_4700s_firmware< comboam4v2_pi_1.2.0.a
▶NVDamd/athlon_3015e_firmware< pollockpi-ft5_1.0.0.5
▶NVDamd/ryzen_3_3300_firmware< comboam4_pi_v1_1.0.0.a+1
▶NVDamd/ryzen_3_4100_firmware< comboam4v2_pi_1.2.0.a
▶NVDamd/ryzen_3_5100_firmware< comboam4v2_pi_1.2.0.a

🔴Vulnerability Details

2
CVEList
CVE-2023-20555: Insufficient input validation in CpmDisplayFeatureSmm may allow an attacker to corrupt SMM memory by overwriting an arbitrary bit in an attacker-contr↗2023-08-08
▶
GHSA
GHSA-vcw6-g65p-gcjw: Insufficient input validation in CpmDisplayFeatureSmm may allow an attacker to corrupt SMM memory by overwriting an arbitrary bit in an attacker-contr↗2023-08-08
▶

📋Vendor Advisories

1
Red Hat
hw: AMD: SMM Memory Corruption Vulnerability↗2023-05-09
▶
CVE-2023-20555 (HIGH CVSS 7.8) | Insufficient input validation in Cp | cvebase.io