Medium severity · published Nov 14, 2023
CVE-2023-20521
TOCTOU in the ASP Bootloader may allow an attacker with physical access to tamper with SPI ROM records after memory content verification, potentially leading to loss of…
5.7
CVSS
0.3%
EPSS
No
On KEV
Description
TOCTOU in the ASP Bootloader may allow an attacker with physical access to tamper with SPI ROM records after memory content verification, potentially leading to loss of confidentiality or a denial of service.
CVSS vector
CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
Attack vector
Physical
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 18% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
1G
1st Gen AMD EPYC™ Processors · AMD
various · source: vendor
2G
2nd Gen AMD EPYC™ Processors · AMD
various · source: vendor
3G
3rd Gen AMD EPYC™ Processors · AMD
various · source: vendor
AE
AMD EPYC™ Embedded 3000 · AMD
various · source: vendor
AE
AMD EPYC™ Embedded 7002 · AMD
various · source: vendor
AE
AMD EPYC™ Embedded 7003 · AMD
various · source: vendor
AR
AMD Ryzen™ Embedded R1000 · AMD
various · source: vendor
AR
AMD Ryzen™ Embedded R2000 · AMD
various · source: vendor
AR
AMD Ryzen™ Embedded V1000 · AMD
various · source: vendor
A3
Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics “Picasso” AM4 · AMD
various · source: vendor
A3
Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics “Pollock” · AMD
various · source: vendor
A3
Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics “Dali”/”Dali” FP5 · AMD
various · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-20521
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-20521
Vendor Advisory
https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-3002
Vendor Advisory
https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-4002
www.amd.com
https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-5001
More from 1st Gen AMD EPYC™ Processors
9.1
CVE-2021-46756
Insufficient validation of inputs in SVC_MAP_USER_STACK in the ASP (AMD Secure Processor) bootloader may allow an attacker with a malicious Uapp or ABL to send malformed or…
8.2
CVE-2022-23829
A potential weakness in AMD SPI protection features may allow a malicious attacker with Ring0 (kernel mode) access to bypass the native System Management Mode (SMM) ROM…
7.5
CVE-2023-31315
Improper validation in a model specific register (MSR) could allow a malicious program with ring0 access to modify SMM configuration while SMI lock is enabled, potentially leading…
7.5
CVE-2021-46774
Insufficient DRAM address validation in System Management Unit (SMU) may allow an attacker to read/write from/to an invalid DRAM address, potentially resulting in…
7.5
CVE-2021-26406
Insufficient validation in parsing Owner's Certificate Authority (OCA) certificates in SEV (AMD Secure Encrypted Virtualization) and SEV-ES user application can lead to a host…