Login Request a demo
Medium severity · published Feb 13, 2024
CVE-2023-20579
Improper Access Control in the AMD SPI protection feature may allow a user with Ring0 (kernel mode) privileged access to bypass protections potentially resulting in loss of…
6.0
CVSS
0.2%
EPSS
No
On KEV
Description
Improper Access Control in the AMD SPI protection feature may allow a user with Ring0 (kernel mode) privileged access to bypass protections potentially resulting in loss of integrity and availability.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
None
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 6% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
R3
Ryzen 3 4300g Firmware · Amd
before comboam4v2pi_1.2.0.c · source: NVD
R3
Ryzen 3 4300ge Firmware · Amd
before comboam4v2pi_1.2.0.c · source: NVD
R3
Ryzen 3 4300u Firmware · Amd
before renoirpi-fp6_1.0.0.d · source: NVD
R3
Ryzen 3 5300g Firmware · Amd
before comboam4v2pi_1.2.0.c · source: NVD
R3
Ryzen 3 5300ge Firmware · Amd
before comboam4v2pi_1.2.0.c · source: NVD
R5
Ryzen 5 4500u Firmware · Amd
before renoirpi-fp6_1.0.0.d · source: NVD
R5
Ryzen 5 4600g Firmware · Amd
before comboam4v2pi_1.2.0.c · source: NVD
R5
Ryzen 5 4600ge Firmware · Amd
before comboam4v2pi_1.2.0.c · source: NVD
R5
Ryzen 5 4600h Firmware · Amd
before renoirpi-fp6_1.0.0.d · source: NVD
R5
Ryzen 5 4600u Firmware · Amd
before renoirpi-fp6_1.0.0.d · source: NVD
R5
Ryzen 5 5500gt Firmware · Amd
before comboam4v2pi_1.2.0.c · source: NVD
R5
Ryzen 5 5600g Firmware · Amd
before comboam4v2pi_1.2.0.c · source: NVD
Affected product
R3
Ryzen 3 4300g Firmware
Amd
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-20579
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-20579
Vendor Advisory
https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-7009
More from Ryzen 3 4300g Firmware
6.8
CVE-2023-20589
An attacker with specialized hardware and physical access to an impacted device may be able to perform a voltage fault injection attack resulting in compromise of the ASP secure…
6.5
CVE-2021-26341
Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage
6.0
CVE-2021-26367
A malicious attacker in x86 can misconfigure the Trusted Memory Regions (TMRs), which may allow the attacker to set an arbitrary address range for the TMR, potentially leading to…
5.6
CVE-2021-26401
LFENCE/JMP (mitigation V2-2) may not sufficiently mitigate CVE-2017-5715 on some AMD CPUs
5.5
CVE-2023-20593
An issue in “Zen 2” CPUs, under specific microarchitectural circumstances, may allow an attacker to potentially access sensitive information