High severity · published Aug 13, 2024
CVE-2022-23815
Improper bounds checking in APCB firmware may allow an attacker to perform an out of bounds write, corrupting the APCB entry, potentially leading to arbitrary code execution
8.2
CVSS
0.2%
EPSS
No
On KEV
Description
Improper bounds checking in APCB firmware may allow an attacker to perform an out of bounds write, corrupting the APCB entry, potentially leading to arbitrary code execution.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 5% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AA
AMD Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics · AMD
various · source: vendor
AA
AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics · AMD
All versions, or not specified · source: vendor
AR
AMD RyzenTM Embedded R1000 · AMD
All versions, or not specified · source: vendor
AR
AMD RyzenTM Embedded R2000 · AMD
All versions, or not specified · source: vendor
AR
AMD RyzenTM Embedded V1000 · AMD
All versions, or not specified · source: vendor
AR
AMD Ryzen™ 3000 Series Mobile Processor with Radeon™ Graphics · AMD
All versions, or not specified · source: vendor
AG
Athlon Gold 3150g Firmware · Amd
All versions, or not specified · source: NVD
AG
Athlon Gold 3150u Firmware · Amd
before picassopi-fp5_1.0.0.e · source: NVD
AG
Athlon Gold Pro 3150g Firmware · Amd
All versions, or not specified · source: NVD
AG
Athlon Gold Pro 3150ge Firmware · Amd
All versions, or not specified · source: NVD
AP
Athlon Pro 300ge Firmware · Amd
All versions, or not specified · source: NVD
AS
Athlon Silver 3050u Firmware · Amd
before picassopi-fp5_1.0.0.e · source: NVD
Affected product
AA
AMD Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics
AMD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-23815
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-23815
Vendor Advisory
https://www.amd.com/en/resources/product-security/bulletin/amd-sb-4004.html
More from AMD Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics
8.8
CVE-2024-36342
Improper input validation in the GPU driver could allow an attacker to exploit a heap overflow potentially resulting in arbitrary code execution
8.5
CVE-2026-0432
Incorrect default permissions in the installation directory for the AMD chipset driver could allow an attacker to achieve privilege escalation resulting in arbitrary code…
8.2
CVE-2024-0179
SMM Callout vulnerability within the AmdCpmDisplayFeatureSMM driver could allow locally authenticated attackers to overwrite SMRAM, potentially resulting in arbitrary code…
8.2
CVE-2021-26344
An out of bounds memory write when processing the AMD PSP1 Configuration Block (APCB) could allow an attacker with access the ability to modify the BIOS image, and the ability to…
7.5
CVE-2024-36354
Improper input validation for DIMM serial presence detect (SPD) metadata could allow an attacker with physical access, ring0 access on a system with a non-compliant DIMM, or…