CVE-2022-23820
CRITICALCVSS 9.8/10EPSS 0.70%
Last modified
CVE-2022-23820 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. Failure to validate the AMD SMM communication buffer may allow an attacker to corrupt the SMRAM potentially leading to arbitrary code execution.. EPSS estimates a 0.70% chance of exploitation in the next 30 days.
Description
Failure to validate the AMD SMM communication buffer may allow an attacker to corrupt the SMRAM potentially leading to arbitrary code execution.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Amd | Ryzen 9 3900 Firmware | comboam4_pi_1.0.0.9 |
| Amd | Ryzen 9 3900 Firmware | comboam4_v2_pi_1.2.0.8 |
| Amd | Ryzen 9 3900x Firmware | comboam4_pi_1.0.0.9 |
| Amd | Ryzen 9 3900x Firmware | comboam4_v2_pi_1.2.0.8 |
| Amd | Ryzen 9 3900xt Firmware | comboam4_pi_1.0.0.9 |
| Amd | Ryzen 9 3900xt Firmware | comboam4_v2_pi_1.2.0.8 |
| Amd | Ryzen 9 3950x Firmware | comboam4_pi_1.0.0.9 |
| Amd | Ryzen 9 3950x Firmware | comboam4_v2_pi_1.2.0.8 |
| Amd | Ryzen 7 3700x Firmware | comboam4_pi_1.0.0.9 |
| Amd | Ryzen 7 3700x Firmware | comboam4_v2_pi_1.2.0.8 |
| Amd | Ryzen 7 3800x Firmware | comboam4_pi_1.0.0.9 |
| Amd | Ryzen 7 3800x Firmware | comboam4_v2_pi_1.2.0.8 |
| Amd | Ryzen 7 3800xt Firmware | comboam4_pi_1.0.0.9 |
| Amd | Ryzen 7 3800xt Firmware | comboam4_v2_pi_1.2.0.8 |
| Amd | Ryzen 5 3500 Firmware | comboam4_pi_1.0.0.9 |
| Amd | Ryzen 5 3500 Firmware | comboam4_v2_pi_1.2.0.8 |
| Amd | Ryzen 5 3500x Firmware | comboam4_pi_1.0.0.9 |
| Amd | Ryzen 5 3500x Firmware | comboam4_v2_pi_1.2.0.8 |
| Amd | Ryzen 5 3600 Firmware | comboam4_pi_1.0.0.9 |
| Amd | Ryzen 5 3600 Firmware | comboam4_v2_pi_1.2.0.8 |
| Amd | Ryzen 5 3600x Firmware | comboam4_pi_1.0.0.9 |
| Amd | Ryzen 5 3600x Firmware | comboam4_v2_pi_1.2.0.8 |
| Amd | Ryzen 5 3600xt Firmware | comboam4_pi_1.0.0.9 |
| Amd | Ryzen 5 3600xt Firmware | comboam4_v2_pi_1.2.0.8 |
| Amd | Ryzen 3 3100 Firmware | comboam4_pi_1.0.0.9 |
| Amd | Ryzen 3 3100 Firmware | comboam4_v2_pi_1.2.0.8 |
| Amd | Ryzen 3 3300x Firmware | comboam4_pi_1.0.0.9 |
| Amd | Ryzen 3 3300x Firmware | comboam4_v2_pi_1.2.0.8 |
| Amd | Ryzen 9 5900 Firmware | comboam4_v2_pi_1.2.0.8 |
| Amd | Ryzen 9 5900x Firmware | comboam4_v2_pi_1.2.0.8 |
| Amd | Ryzen 9 5950x Firmware | comboam4_v2_pi_1.2.0.8 |
| Amd | Ryzen 9 Pro 5945 Firmware | comboam4_v2_pi_1.2.0.8 |
| Amd | Ryzen 7 Pro 5845 Firmware | comboam4_v2_pi_1.2.0.8 |
| Amd | Ryzen 7 5800 Firmware | comboam4_v2_pi_1.2.0.8 |
| Amd | Ryzen 7 5800x Firmware | comboam4_v2_pi_1.2.0.8 |
| Amd | Ryzen 7 5700x Firmware | comboam4_v2_pi_1.2.0.8 |
| Amd | Ryzen 5 5600 Firmware | comboam4_v2_pi_1.2.0.8 |
| Amd | Ryzen 5 5600x Firmware | comboam4_v2_pi_1.2.0.8 |
| Amd | Ryzen 5 56003xd Firmware | comboam4_v2_pi_1.2.0.8 |
| Amd | Ryzen 5 Pro 5645 Firmware | comboam4_v2_pi_1.2.0.8 |
| Amd | Ryzen 5 5500 Firmware | comboam4v2_pi_1.2.0.8 |
| Amd | Ryzen 5 5500x Firmware | comboam4v2_pi_1.2.0.8 |
| Amd | Ryzen 5 55003xd Firmware | comboam4v2_pi_1.2.0.8 |
| Amd | Ryzen 7 5700 Firmware | comboam4v2_pi_1.2.0.8 |
| Amd | Ryzen 3 5100 Firmware | comboam4v2_pi_1.2.0.8 |
| Amd | Ryzen 5 Pro 3400g Firmware | comboam4_pi_1.0.0.9 |
| Amd | Ryzen 5 Pro 3400g Firmware | comboam4_v2_pi_1.2.0.8 |
| Amd | Ryzen 5 Pro 3400ge Firmware | comboam4_pi_1.0.0.9 |
| Amd | Ryzen 5 Pro 3400ge Firmware | comboam4_v2_pi_1.2.0.8 |
| Amd | Ryzen 5 Pro 3350g Firmware | comboam4_pi_1.0.0.9 |
Showing 50 of 123 affected configurations. See NVD for the full list.
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-23820?
Failure to validate the AMD SMM communication buffer
may allow an attacker to corrupt the SMRAM potentially leading to arbitrary
code execution.
How severe is CVE-2022-23820?
CVE-2022-23820 has a CVSS score of 9.8/10 (CRITICAL severity). The EPSS model estimates a 0.70% probability of exploitation in the next 30 days.
How do I fix CVE-2022-23820?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-23814Failure to validate addresses provided by software to BIOS c…5.3
- CVE-2022-23815Improper bounds checking in APCB firmware may allow an attac…8.2
- CVE-2022-23816Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2022-23817Insufficient checking of memory buffer in AMD Secure Process…7.3
- CVE-2022-23818Insufficient input validation on the model specific register…7.5
- CVE-2022-2382The Product Slider for WooCommerce WordPress plugin before 2…4.3
- CVE-2022-23821Improper access control in System Management Mode (SMM) may …9.8
- CVE-2022-23822In this physical attack, an attacker may potentially exploit…6.8
- CVE-2022-23823A potential vulnerability in some AMD processors using frequ…6.5
- CVE-2022-23824IBPB may not prevent return branch predictions from being sp…5.5
- CVE-2022-23825Aliases in the branch predictor may cause some AMD processor…6.5
- CVE-2022-23826A TOCTOU (Time-Of-Check to Time-Of-Use) in the graphics inte…1.8
Are you affected by CVE-2022-23820?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST