Lucene search

[email protected]CVE-2023-20526

HistoryNov 14, 2023 - 7:15 p.m.

CVE-2023-20526

2023-11-1419:15:15

NVD-CWE-noinfo

[email protected]

web.nvd.nist.gov

cve-2023-20526

asp bootloader

input validation

physical access

confidentiality

nvd

4.6 Medium

CVSS3

Attack Vector

PHYSICAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

5.1 Medium

AI Score

Confidence

High

2.1 Low

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

0.001 Low

EPSS

Percentile

19.7%

JSON

Insufficient input validation in the ASP Bootloader may enable a privileged attacker with physical access to expose the contents of ASP memory potentially leading to a loss of confidentiality.

CPENameOperatorVersion
amd:epyc_7001_firmwareamd epyc 7001 firmwareltnaplespi_1.0.0.h
amd:epyc_7001_firmwareamd epyc 7001 firmwareeq-
amd:epyc_7001_firmwareamd epyc 7001 firmwareeqnaplespi-sp3_1.0.0.g
amd:epyc_7001_firmwareamd epyc 7001 firmwareeqnaplespi-sp3_1.0.0.h
amd:epyc_7001_firmwareamd epyc 7001 firmwareeqnaplespi_1.0.0.g

CPE	Name	Operator	Version
amd:epyc_7001_firmware	amd epyc 7001 firmware	lt	naplespi_1.0.0.h
amd:epyc_7001_firmware	amd epyc 7001 firmware	eq	-
amd:epyc_7001_firmware	amd epyc 7001 firmware	eq	naplespi-sp3_1.0.0.g
amd:epyc_7001_firmware	amd epyc 7001 firmware	eq	naplespi-sp3_1.0.0.h
amd:epyc_7001_firmware	amd epyc 7001 firmware	eq	naplespi_1.0.0.g

References

www.amd.com/en/corporate/product-security/bulletin/AMD-SB-3002

www.amd.com/en/corporate/product-security/bulletin/AMD-SB-4002

www.amd.com/en/corporate/product-security/bulletin/AMD-SB-5001

4.6 Medium

CVSS3

Attack Vector

PHYSICAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

5.1 Medium

AI Score

Confidence

High

2.1 Low

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

0.001 Low

EPSS

Percentile

19.7%

JSON

Related for CVE-2023-20526

prion1 cvelist1 amd3 openvas3 nessus2