Skip to content
fr Sign in
7.5 High

CVE-2023-20578 A TOCTOU (Time-Of-Check-Time-Of-Use) in SMM may allow an attacker with ring0 privileges and access to the BIOS menu or…

Description

A TOCTOU (Time-Of-Check-Time-Of-Use) in SMM may allow an attacker with ring0 privileges and access to the BIOS menu or UEFI shell to modify the communications buffer potentially resulting in arbitrary code execution.

Affected products and versions

Product Affected versions Fixed in
AMD EPYC™ 7001 Processors Versions not published
AMD EPYC™ 7002 Processors Versions not published
AMD EPYC™ 7003 Processors Versions not published
AMD EPYC™ 9004 Processors Versions not published
AMD Ryzen™ 7000 Series Desktop Processors Versions not published
AMD Ryzen™ Threadripper™ PRO 5000WX Processors Versions not published
AMD Ryzen™ 7020 Series Processors with Radeon™ Graphics Versions not published
AMD Ryzen™ 6000 Series Processors with Radeon™ Graphics Versions not published
AMD Ryzen™ 7035 Series Processors with Radeon™ Graphics Versions not published
Show the 15 other branches
Product Affected versions Fixed in
AMD EPYC™ Embedded 3000 Versions not published
AMD EPYC™ Embedded 7002 Versions not published
AMD EPYC™ Embedded 7003 Versions not published
AMD EPYC™ Embedded 9003 Versions not published
AMD Ryzen™ Embedded 7000 Versions not published
AMD RyzenTM Embedded V3000 Versions not published
epyc_7001 1.0 earliest → < 1.0.0.k 1.0.0.k
epyc_7002 1.0 earliest → < 1.0.0.g 1.0.0.g
epyc_9004 1.0 earliest → < 1.0.0.2 1.0.0.2
epyc_embedded_3000 1.1 earliest → < 1.1.0.a 1.1.0.a
epyc_embedded_7002 1.0 earliest → < 1.0.0.a 1.0.0.a
epyc_embedded_7003 1.0 earliest → < 1.0.0.7 1.0.0.7
epyc_embedded_9003 1.0 earliest → < 1.0.0.0 1.0.0.0
ryzen_embedded_7000 1.0 earliest → < 1.0.0.0 1.0.0.0
ryzen_embedded_v3000 1.0 earliest → < 1.0.0.8 1.0.0.8

References

Timeline

  1. Published
  2. Last modified

Other CVEs of AMD EPYC™ 7001 Processors

The 3 CVEs of AMD EPYC™ 7001 Processors →
CVE-2024-21925 Improper input validation within the AmdPspP2CmboxV2 driver may allow a privileged attacker to overwrite SMRAM,… 8.2 High CVE-2021-46746 Lack of stack protection exploit mechanisms in ASP Secure OS Trusted Execution Environment (TEE) may allow a… 5.2 Medium
Track this CVE