Log in Start free

Vulnerability · Published Aug 9, 2024 · Assigned by AMD

CVE-2023-31315

High 7.5

In plain English

A high-severity code injection in 1st Gen AMD EPYC™ Processors from AMD. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.6%top 49.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Improper validation in a model specific register (MSR) could allow a malicious program with ring0 access to modify SMM configuration while SMI lock is enabled, potentially leading to arbitrary code execution.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12amd64-microcode3.20240710.2~deb12u1DEBIAN-CVE-2023-31315
Debian:13amd64-microcode3.20240710.1DEBIAN-CVE-2023-31315
Debian:14amd64-microcode3.20240710.1DEBIAN-CVE-2023-31315
Rocky Linux:8linux-firmware0:20240827-124.git3cff7109.el8_10RLSA-2024:7481
Ubuntu:22.04:LTSamd64-microcode3.20191218.1ubuntu2.3USN-7077-1
Ubuntu:22.04:LTSamd64-microcode3.20191218.1ubuntu2.3UBUNTU-CVE-2023-31315
Ubuntu:24.04:LTSamd64-microcode3.20231019.1ubuntu2.1USN-7077-1
Ubuntu:24.04:LTSamd64-microcode3.20231019.1ubuntu2.1UBUNTU-CVE-2023-31315

Affected products (as reported)

VendorProductVersions
AMD 3rd Gen AMD EPYC™ Processors various – before Milan PI 1.0.0.D
AMD 1st Gen AMD EPYC™ Processors various – before Naples PI 1.0.0.M
AMD 2nd Gen AMD EPYC™ Processors various – before Rome PI 1.0.0.J
AMD 4th Gen AMD EPYC™ Processors see references
AMD AMD EPYC™ Embedded 3000 various
AMD AMD EPYC™ Embedded 7002 various
AMD AMD EPYC™ Embedded 7003 various
AMD AMD EPYC™ Embedded 9003 see references
AMD AMD Ryzen™ Embedded R1000 various
AMD AMD Ryzen™ Embedded R2000 various
AMD AMD Ryzen™ Embedded 5000 various
AMD AMD Ryzen™ Embedded 7000 various
AMD AMD Ryzen™ Embedded V1000 various
AMD AMD Ryzen™ Embedded V2000 various
AMD AMD Ryzen™ Embedded V3000 various
AMD AMD Ryzen™ 3000 Series Desktop Processors various
AMD AMD Ryzen™ 5000 Series Desktop Processors see references
AMD AMD Ryzen™ 5000 Series Desktop processor with Radeon™ Graphics see references
AMD AMD Ryzen™ 7000 Series Desktop Processors various – before ComboAM5PI 1.2.0.1
AMD AMD Ryzen™ 4000 Series Desktop Processors with Radeon™ Graphics various – before ComboAM4v2PI 1.2.0.cb
AMD AMD Ryzen™ Threadripper™ 3000 Series Processors various – before CastlePeakPI-SP3r3 1.0.0.B
AMD AMD Ryzen™ Threadripper™ PRO Processors various – before ChagallWSPI-sWRX8 1.0.0.8
AMD AMD Ryzen™ Threadripper™ PRO 3000WX Series Processors see references
AMD AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics see references
AMD AMD Ryzen™ 3000 Series Mobile Processor with Radeon™ Graphics various – before Picasso-FP5 1.0.1.2
AMD AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics see references
AMD AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics see references
AMD AMD Ryzen™ 7030 Series Mobile Processors with Radeon™ Graphics various – before CezannePI-FP6
AMD AMD Ryzen™ 7040 Series Mobile Processors with Radeon™ Graphics see references
AMD AMD Ryzen™ 7045 Series Mobile Processors see references

Weakness: CWE-94 · Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

References