Persistence of Untrusted Platform Configuration Risks Memory Access
CVE-2023-20591

10CRITICAL

Key Information:

Vendor
Amd
Status
Amd Epyc™ 7003 Series Processors
Amd Epyc™ 9004 Series Processors
Amd Epyc™ Embedded 7003 Series Processors
Amd Epyc™ Embedded 9003 Series Processors
Vendor
CVE Published:
13 August 2024

Summary

The vulnerability arises from the improper re-initialization of the Input/Output Memory Management Unit (IOMMU) during the Dynamic Root of Trust for Measurement (DRTM) event. This flaw may enable an untrusted platform configuration to persist, which could allow attackers to read or modify hypervisor memory. The repercussions of this vulnerability include potential threats to the confidentiality, integrity, and availability of the affected systems, marking significant concerns for users relying on AMD hypervisor technologies.

Affected Version(s)

AMD EPYC™ 7003 Series Processors MilanPI 1.0.0.B

AMD EPYC™ 9004 Series Processors Genoa 1.0.0.8

AMD EPYC™ Embedded 7003 Series Processors EmbMilanPI-SP3 1.0.0.7

References

https://www.amd.com/en/resources/product-security/bulleti...
vendor-advisory

CVSS V3.1

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Collectors

NVD DatabaseMitre Database
.