AMD 3rd Gen AMD EPYC™ Processors

CVE-2023-31315

HIGH 7.5

En bref

Source: NVD
EPSS: EPSS 0.63 % · centile 50 (2026-10-29)
État: PUBLISHED
Publiée: 2024-08-09 17:08 UTC
Mise à jour: 2024-09-12 12:56 UTC
Attribuée par: AMD
Statut NVD: Deferred

Rechercher sur…

Description

Improper validation in a model specific register (MSR) could allow a malicious program with ring0 access to modify SMM configuration while SMI lock is enabled, potentially leading to arbitrary code execution.

Faiblesses (CWE)

CWE-94 — Injection de code

Références

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H	AMD
CVSS 3.1	MEDIUM 6.8	CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L	CISA-ADP
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H	NVD · psirt@amd.com (Secondary)
CVSS 3.1	MEDIUM 6.8	CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L	NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Références européennes

ENISA EUVD · EUVD-2023-35626
GCVE · GCVE-0-2023-31315

Avis du CERT-FR

CERTFR-2025-AVI-0113 — Multiples vulnérabilités dans les produits Siemens · cert.ssi.gouv.fr
CERTFR-2025-AVI-0086 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2024-AVI-1079 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
CERTFR-2024-AVI-0747 — Vulnérabilité dans le noyau Linux de SUSE · cert.ssi.gouv.fr
CERTFR-2024-AVI-0717 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
CERTFR-2024-AVI-0693 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr

Produits affectés

Produit	Versions
AMD · 3rd Gen AMD EPYC™ Processors	affected various < Milan PI 1.0.0.D
AMD · 1st Gen AMD EPYC™ Processors	affected various < Naples PI 1.0.0.M
AMD · 2nd Gen AMD EPYC™ Processors	affected various < Rome PI 1.0.0.J
AMD · 4th Gen AMD EPYC™ Processors	unaffected various < Genoa PI 1.0.0.C
AMD · AMD EPYC™ Embedded 3000	affected various
AMD · AMD EPYC™ Embedded 7002	affected various
AMD · AMD EPYC™ Embedded 7003	affected various
AMD · AMD EPYC™ Embedded 9003	unaffected various < EmbGenoaPI 1.0.0.7
AMD · AMD Ryzen™ Embedded R1000	affected various
AMD · AMD Ryzen™ Embedded R2000	affected various
AMD · AMD Ryzen™ Embedded 5000	affected various
AMD · AMD Ryzen™ Embedded 7000	affected various
AMD · AMD Ryzen™ Embedded V1000	affected various
AMD · AMD Ryzen™ Embedded V2000	affected various
AMD · AMD Ryzen™ Embedded V3000	affected various
AMD · AMD Ryzen™ 3000 Series Desktop Processors	affected various
AMD · AMD Ryzen™ 5000 Series Desktop Processors	unaffected various < ComboAM4v2PI 1.2.0.cb
AMD · AMD Ryzen™ 5000 Series Desktop processor with Radeon™ Graphics	unaffected various < ComboAM4v2PI 1.2.0.cb
AMD · AMD Ryzen™ 7000 Series Desktop Processors	affected various < ComboAM5PI 1.2.0.1
AMD · AMD Ryzen™ 4000 Series Desktop Processors with Radeon™ Graphics	affected various < ComboAM4v2PI 1.2.0.cb

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD

⚠️ AMD 3rd Gen AMD EPYC™ Processors