CVE-2023-20591

published 2024-08-13

CVE-2023-20591: Improper re-initialization of IOMMU during the DRTM event may permit an untrusted platform configuration to persist, allowing an attacker to read or modify…

Priority P3 55 critical 10 CVSS 3.1

AV N AC L PR N UI N S C C H I H A H

Improper re-initialization of IOMMU during the DRTM event
may permit an untrusted platform configuration to persist, allowing an attacker
to read or modify hypervisor memory, potentially resulting in loss of
confidentiality, integrity, and availability.

Affected

65 ranges · showing 25

Vendor	Product	Version range	Fixed in
amd	epyc_7203_firmware	< milanpi_1.0.0.b	milanpi_1.0.0.b
amd	epyc_7203p_firmware	< milanpi_1.0.0.b	milanpi_1.0.0.b
amd	epyc_72f3_firmware	< milanpi_1.0.0.b	milanpi_1.0.0.b
amd	epyc_7303_firmware	< milanpi_1.0.0.b	milanpi_1.0.0.b
amd	epyc_7303p_firmware	< milanpi_1.0.0.b	milanpi_1.0.0.b
amd	epyc_7313_firmware	< milanpi_1.0.0.b	milanpi_1.0.0.b
amd	epyc_7313p_firmware	< milanpi_1.0.0.b	milanpi_1.0.0.b
amd	epyc_7343_firmware	< milanpi_1.0.0.b	milanpi_1.0.0.b
amd	epyc_7373x_firmware	< milanpi_1.0.0.b	milanpi_1.0.0.b
amd	epyc_73f3_firmware	< milanpi_1.0.0.b	milanpi_1.0.0.b
amd	epyc_7413_firmware	< milanpi_1.0.0.b	milanpi_1.0.0.b
amd	epyc_7443_firmware	< milanpi_1.0.0.b	milanpi_1.0.0.b
amd	epyc_7443p_firmware	< milanpi_1.0.0.b	milanpi_1.0.0.b
amd	epyc_7453_firmware	< milanpi_1.0.0.b	milanpi_1.0.0.b
amd	epyc_7473x_firmware	< milanpi_1.0.0.b	milanpi_1.0.0.b
amd	epyc_74f3_firmware	< milanpi_1.0.0.b	milanpi_1.0.0.b
amd	epyc_7513_firmware	< milanpi_1.0.0.b	milanpi_1.0.0.b
amd	epyc_7543_firmware	< milanpi_1.0.0.b	milanpi_1.0.0.b
amd	epyc_7543p_firmware	< milanpi_1.0.0.b	milanpi_1.0.0.b
amd	epyc_7573x_firmware	< milanpi_1.0.0.b	milanpi_1.0.0.b
amd	epyc_75f3_firmware	< milanpi_1.0.0.b	milanpi_1.0.0.b
amd	epyc_7643_firmware	< milanpi_1.0.0.b	milanpi_1.0.0.b
amd	epyc_7643p_firmware	< milanpi_1.0.0.b	milanpi_1.0.0.b
amd	epyc_7663_firmware	< milanpi_1.0.0.b	milanpi_1.0.0.b
amd	epyc_7663p_firmware	< milanpi_1.0.0.b	milanpi_1.0.0.b

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-665