by Kastro
Paper/Archive/CVE-2022-23821

CVE-2022-23821

AMD Ryzen™ 3000 Series Desktop Processors “Matisse” — Improper access control in System Management Mode (SMM) may allow an attacker to write to SPI ROM potentially leading to arbitrary code e…

EPSS 1.0%CVSS 9.8
critical.is priorityof 100
42
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 62.5.625 × 2012.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Improper access control in System Management Mode (SMM) may allow an attacker to write to SPI ROM potentially leading to arbitrary code execution.

Affected

ProductAffectedFixed inSource
Ryzen™ 3000 Series Desktop Processors “Matisse”various –CNA
Ryzen™ 5000 Series Desktop Processors “Vermeer”various –CNA
Ryzen™ 5000 Series Desktop Processor with Radeon™ Graphics “Cezanne”various –CNA
Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics “Picasso” AM4various –CNA
Ryzen™ Threadripper™ 2000 Series Processors “Colfax”various –CNA
Ryzen™ Threadripper™ 3000 Series Processors “Castle Peak” HEDTvarious –CNA
Ryzen™ Threadripper™ PRO Processors “Castle Peak” WS SP3various –CNA
Ryzen™ Threadripper™ PRO 3000WX Series Processors “Chagall” WSvarious –CNA
Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics “Dali”/”Dali” FP5various –CNA
Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics “Pollock”various –CNA
Ryzen™ 3000 Series Mobile Processor with Radeon™ Graphics “Picasso” FP5various –CNA
Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics “Renoir” FP6various –CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisoryamd.com/en/corporate/product-security/bulletin/AMD-SB-4002advisoryamd.com/en/corporate/product-security/bulletin/AMD-SB-5001