Strix
66.6K

CVE-2023-20577

HIGHCVSS 7.4/10EPSS 0.16%

Last modified

CVE-2023-20577 is a high-severity vulnerability rated 7.4/10 on the CVSS scale. A heap overflow in SMM module may allow an attacker with access to a second vulnerability that enables writing to SPI flash, potentially resulting in arbitrary code execution.. EPSS estimates a 0.16% chance of exploitation in the next 30 days.

Description

A heap overflow in SMM module may allow an attacker with access to a second vulnerability that enables writing to SPI flash, potentially resulting in arbitrary code execution.

Metrics

CVSS 3.1
7.4/10

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Probability
0.16%

5.4th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
AMD2nd Gen AMD EPYC™ ProcessorsAll versions
AMD3rd Gen AMD EPYC™ ProcessorsAll versions
AMD4th Gen AMD EPYC™ ProcessorsAll versions
AMDAMD Instinct™ MI300AAll versions
AMDAMD Ryzen™ 3000 Series Desktop ProcessorsAll versions
AMDAMD Ryzen™ 5000 Series Desktop ProcessorsAll versions
AMDAMD Ryzen™ 5000 Series Desktop Processors with Radeon™ GraphicsAll versions
AMDAMD Ryzen™ 7000 Series ProcessorsAll versions
AMDAMD Athlon™ 3000 Series Desktop Processors with Radeon™ GraphicsAll versions
AMDAMD Ryzen™ 4000 Series Desktop Processors with Radeon™ GraphicsAll versions
AMDAMD Ryzen™ Threadripper™ 3000 Series ProcessorsAll versions
AMDAMD Ryzen™ Threadripper™ PRO 3000WX Series ProcessorsAll versions
AMDAMD Ryzen™ Threadripper™ PRO 5000WX ProcessorsAll versions
AMDAMD Athlon™ 3000 Series Mobile Processors with Radeon™ GraphicsAll versions
AMDAMD Ryzen™ 3000 Series Mobile Processor with Radeon™ GraphicsAll versions
AMDAMD Ryzen™ 4000 Series Mobile Processors with Radeon™ GraphicsAll versions
AMDAMD Ryzen™ 5000 Series Mobile Processors with Radeon™ GraphicsAll versions
AMDAMD Ryzen™ 7020 Series Processors with Radeon™ GraphicsAll versions
AMDAMD Ryzen™ 6000 Series Processors with Radeon™ GraphicsAll versions
AMDAMD Ryzen™ 7035 Series Processors with Radeon™ GraphicsAll versions
AMDAMD Ryzen™ 5000 Series Processors with Radeon™ GraphicsAll versions
AMDAMD Ryzen™ 3000 Series Processors with Radeon™ GraphicsAll versions
AMDAMD Ryzen™ 7040 Series Processors with Radeon™ GraphicsAll versions
AMDAMD Ryzen™ 7045 Series Mobile ProcessorsAll versions
AMDAMD EPYC™ Embedded 3000All versions
AMDAMD EPYC™ Embedded 7002All versions
AMDAMD EPYC™ Embedded 7003All versions
AMDAMD EPYC™ Embedded 9003All versions
AMDAMD Ryzen™ Embedded R1000All versions
AMDAMD Ryzen™ Embedded R2000All versions
AMDAMD Ryzen™ Embedded 5000All versions
AMDAMD Ryzen™ Embedded V1000All versions
AMDAMD Ryzen™ Embedded V2000All versions
AMDAMD Ryzen™ Embedded V3000All versions

References

Timeline

Published
Last Modified
Status
Awaiting Analysis

Frequently Asked Questions

What is CVE-2023-20577?
A heap overflow in SMM module may allow an attacker with access to a second vulnerability that enables writing to SPI flash, potentially resulting in arbitrary code execution.
How severe is CVE-2023-20577?
CVE-2023-20577 has a CVSS score of 7.4/10 (HIGH severity). The EPSS model estimates a 0.16% probability of exploitation in the next 30 days.
How do I fix CVE-2023-20577?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2023

View all 2023CVEs →

Are you affected by CVE-2023-20577?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST