Insufficient Input Validation in ASP Bootloader from AMD
CVE-2023-20526

4.6MEDIUM

Key Information:

Vendor

Amd
Status
Amd Ryzen™ Threadripper™ 2000 Series Processors “colfax”
1st Gen Amd Epyc™ Processors
2nd Gen Amd Epyc™ Processors
3rd Gen Amd Epyc™ Processors
Vendor
CVE Published:
14 November 2023

What is CVE-2023-20526?

The ASP Bootloader by AMD is susceptible to a vulnerability that stems from insufficient input validation, allowing a privileged attacker with physical access to potentially access and expose sensitive ASP memory contents. This could result in a significant loss of confidentiality, making it crucial for users to prioritize security measures to mitigate the risk associated with this flaw.

Affected Version(s)

1st Gen AMD EPYC™ Processors x86 various

2nd Gen AMD EPYC™ Processors x86 various

3rd Gen AMD EPYC™ Processors x86 various

References

https://www.amd.com/en/corporate/product-security/bulleti...
vendor-advisory
https://www.amd.com/en/corporate/product-security/bulleti...
vendor-advisory
https://www.amd.com/en/corporate/product-security/bulleti...
vendor-advisory

CVSS V3.1

Score:
4.6
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Physical
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.