Medium severity · published Feb 13, 2024
CVE-2023-20579
Improper Access Control in the AMD SPI protection feature may allow a user with Ring0 (kernel mode) privileged access to bypass protections potentially resulting in loss of…
6.0
CVSS
0.2%
EPSS
No
On KEV
Description
Improper
Access Control in the AMD SPI protection feature may allow a user with Ring0
(kernel mode) privileged access to bypass protections potentially resulting in
loss of integrity and availability.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
None
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 6% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AR
AMD Ryzen™ 3000 Series Processors with Radeon™ Graphics · AMD
various · source: vendor
AR
AMD Ryzen™ 4000 Series Desktop Processors with Radeon™ Graphics · AMD
various · source: vendor
AR
AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics · AMD
various · source: vendor
AR
AMD Ryzen™ 5000 Series Desktop Processor with Radeon™ Graphics · AMD
various · source: vendor
AR
AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics · AMD
various · source: vendor
AR
AMD Ryzen™ 5000 Series Processors with Radeon™ Graphics · AMD
various · source: vendor
AR
AMD Ryzen™ 6000 Series Processors with Radeon™ Graphics · AMD
various · source: vendor
AR
AMD Ryzen™ 7000 Series Desktop Processor · AMD
Various · source: vendor
AR
AMD Ryzen™ 7020 Series Processors with Radeon™ Graphics · AMD
various · source: vendor
AR
AMD Ryzen™ 7035 Series Mobile Processors with Radeon™ Graphics · AMD
various · source: vendor
AR
AMD Ryzen™ 7040 Series Mobile Processors with Radeon™ Graphics · AMD
various ; various · source: vendor
AR
AMD Ryzen™ 7045 Series Mobile Processors · AMD
various · source: vendor
Affected product
AR
AMD Ryzen™ 3000 Series Processors with Radeon™ Graphics
AMD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-20579
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-20579
Vendor Advisory
https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-7009
More from AMD Ryzen™ 3000 Series Processors with Radeon™ Graphics
8.2
CVE-2021-26344
An out of bounds memory write when processing the AMD PSP1 Configuration Block (APCB) could allow an attacker with access the ability to modify the BIOS image, and the ability to…
7.4
CVE-2023-20577
A heap overflow in SMM module may allow an attacker with access to a second vulnerability that enables writing to SPI flash, potentially resulting in arbitrary code execution
6.0
CVE-2021-26367
A malicious attacker in x86 can misconfigure the Trusted Memory Regions (TMRs), which may allow the attacker to set an arbitrary address range for the TMR, potentially leading to…
5.2
CVE-2021-46746
Lack of stack protection exploit mechanisms in ASP Secure OS Trusted Execution Environment (TEE) may allow a privileged attacker with access to AMD signing keys to c006Frrupt the…
3.9
CVE-2021-46772
Insufficient input validation in the ABL may allow a privileged attacker with access to the BIOS menu or UEFI shell to tamper with the structure headers in SPI ROM causing an out…