Improper Input Validation in SMM Handler Affects AMD Products
CVE-2023-31342

7.5HIGH

Key Information:

Vendor
Amd
Status
Amd Epyc™ 7003 Processors
Amd Epyc™ 9004 Processors
Amd Instinct™ Mi300a
Amd Ryzen™ 3000 Series Desktop Processors
Vendor
CVE Published:
11 February 2025

Summary

A vulnerability exists in the System Management Mode (SMM) handler of certain AMD processors due to improper input validation. This security flaw enables a privileged attacker to overwrite System Management RAM (SMRAM), which may potentially lead to arbitrary code execution. It is essential for users and administrators of affected AMD products to apply security best practices and updates to mitigate this risk.

Affected Version(s)

AMD Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics ComboAM4v2PI 1.2.0.C

AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics Pollock-FT5 1.0.0.7

AMD EPYC™ 7003 Processors MilanPI 1.0.0.C

References

https://www.amd.com/en/resources/product-security/bulleti...
https://www.amd.com/en/resources/product-security/bulleti...
https://www.amd.com/en/resources/product-security/bulleti...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.