CVE-2023-20558

CWE-6703 documents3 sources

Severity

8.8HIGH

EPSS

0.4%

top 39.73%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

AMD Ryzen 3 2200u Firmware AMD Ryzen 3 2300u Firmware AMD Ryzen 3 3300x Firmware +78 more

Timeline

PublishedApr 2

Description

Insufficient control flow management in AmdCpmOemSmm may allow a privileged attacker to tamper with the SMM handler potentially leading to an escalation of privileges.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages81 packages

▶NVDamd/ryzen_5_2600_firmware< comboam4v2_pi_1.2.0.6c

▶NVDamd/ryzen_5_2700_firmware< comboam4v2_pi_1.2.0.6c

▶NVDamd/ryzen_5_3500_firmware< comboam4_v2_pi_1.2.0.6c

▶NVDamd/ryzen_5_3600_firmware< comboam4_v2_pi_1.2.0.6c

▶NVDamd/ryzen_7_2700_firmware< comboam4v2_pi_1.2.0.6c

🔴Vulnerability Details

GHSA

GHSA-xq4j-j5qp-3mfq: Insufficient control flow management in AmdCpmOemSmm may allow a privileged attacker to tamper with the SMM handler potentially leading to an escalati↗2023-04-02

▶

CVEList

CVE-2023-20558: Insufficient control flow management in AmdCpmOemSmm may allow a privileged attacker to tamper with the SMM handler potentially leading to an escalati↗2023-03-23

▶