CVE-2023-31342: Improper input validation in the SMM handler may allow a privileged attacker to overwrite SMRAM, potentially leading to arbitrary code execution | LiveThreat CVE Feed — Verisq

Login Request a demo

High severity · published Feb 11, 2025

CVE-2023-31342

Improper input validation in the SMM handler may allow a privileged attacker to overwrite SMRAM, potentially leading to arbitrary code execution

7.5

CVSS

0.2%

EPSS

No

On KEV

Description

Improper input validation in the SMM handler may allow a privileged attacker to overwrite SMRAM, potentially leading to arbitrary code execution.

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack vector

Local

Complexity

High

Privileges

High

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Changed

Exploitation

Is it being used?

Exploit prediction (EPSS)0.2% · higher than 8% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

AA

AMD Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics · AMD

All versions, or not specified · source: vendor

AA

AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics · AMD

All versions, or not specified · source: vendor

AE

AMD EPYC™ 7003 Processors · AMD

All versions, or not specified · source: vendor

AE

AMD EPYC™ 9004 Processors · AMD

All versions, or not specified · source: vendor

AE

AMD EPYC™ Embedded 7003 · AMD

All versions, or not specified · source: vendor

AE

AMD EPYC™ Embedded 9004 · AMD

All versions, or not specified · source: vendor

AI

AMD Instinct™ MI300A · AMD

All versions, or not specified · source: vendor

AR

AMD Ryzen™ 3000 Series Desktop Processors · AMD

All versions, or not specified · source: vendor

AR

AMD Ryzen™ 3000 Series Mobile Processor with Radeon™ Graphics · AMD

All versions, or not specified · source: vendor

AR

AMD Ryzen™ 4000 Series Desktop Processor with Radeon™ Graphics · AMD

All versions, or not specified · source: vendor

AR

AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics · AMD

All versions, or not specified · source: vendor

AR

AMD Ryzen™ 5000 Series Desktop Processor with Radeon™ Graphics · AMD

All versions, or not specified · source: vendor

Affected product

AA

AMD Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics

AMD

All AMD Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics CVEs

References

https://nvd.nist.gov/vuln/detail/CVE-2023-31342

https://www.cve.org/CVERecord?id=CVE-2023-31342

https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3009.html

https://www.amd.com/en/resources/product-security/bulletin/amd-sb-4008.html

https://www.amd.com/en/resources/product-security/bulletin/amd-sb-5004.html

More from AMD Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics

8.8

Improper input validation in the GPU driver could allow an attacker to exploit a heap overflow potentially resulting in arbitrary code execution

8.5

Incorrect default permissions in the installation directory for the AMD chipset driver could allow an attacker to achieve privilege escalation resulting in arbitrary code…

8.2

SMM Callout vulnerability within the AmdCpmDisplayFeatureSMM driver could allow locally authenticated attackers to overwrite SMRAM, potentially resulting in arbitrary code…

7.5

Improper input validation for DIMM serial presence detect (SPD) metadata could allow an attacker with physical access, ring0 access on a system with a non-compliant DIMM, or…

7.5

Improper input validation in the system management mode (SMM) could allow a privileged attacker to overwrite arbitrary memory potentially resulting in arbitrary code execution at…