by Kastro
Paper/Archive/CVE-2022-23820

CVE-2022-23820

AMD Ryzen™ 3000 series Desktop Processors “Matisse" — Failure to validate the AMD SMM communication buffer may allow an attacker to corrupt the SMRAM potentially leading to arbitrary code exe…

EPSS 0.7%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 53.1.531 × 2010.6No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Failure to validate the AMD SMM communication buffer may allow an attacker to corrupt the SMRAM potentially leading to arbitrary code execution.

Affected

ProductAffectedFixed inSource
Ryzen™ 3000 series Desktop Processors “Matisse"various–CNA
AMD Ryzen™ 5000 Series Desktop Processors “Vermeer”various–CNA
AMD Ryzen™ 5000 Series Desktop Processor with Radeon™ Graphics “Cezanne”various–CNA
AMD Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics “Picasso” AM4various–CNA
AMD Ryzen™ Threadripper™ 2000 Series Processors “Colfax”Various–CNA
AMD Ryzen™ Threadripper™ 3000 Series Processors “Castle Peak” HEDTvarious–CNA
AMD Ryzen™ Threadripper™ PRO Processors “Castle Peak” WS SP3various–CNA
AMD Ryzen™ Threadripper™ PRO 3000WX Series Processors “Chagall” WSvarious–CNA
AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics “Pollock”various–CNA
AMD Ryzen™ 3000 Series Mobile Processor with Radeon™ Graphics “Picasso” FP5various–CNA
AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics “Renoir” FP6various–CNA
AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics “Lucienne”various–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AMD (CNA)7.5CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

References

advisoryamd.com/en/corporate/product-security/bulletin/AMD-SB-4002advisoryamd.com/en/corporate/product-security/bulletin/AMD-SB-3002advisoryamd.com/en/corporate/product-security/bulletin/AMD-SB-5001