CVE-2023-31356

2024-08-1317:15:21

AMD

web.nvd.nist.gov

memory cleanup

sev firmware

data integrity

CVSS3

4.4

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

AI Score

Confidence

Low

EPSS

Percentile

9.5%

JSON

Incomplete system memory cleanup in SEV firmware could
allow a privileged attacker to corrupt guest private memory, potentially
resulting in a loss of data integrity.

CNA Affected

[
  {
    "defaultStatus": "affected",
    "product": "AMD EPYC™ 7003 Processors",
    "vendor": "AMD",
    "versions": [
      {
        "status": "unaffected",
        "version": "MilanPI 1.0.0.C",
        "versionType": "PI"
      }
    ]
  },
  {
    "defaultStatus": "affected",
    "product": "AMD EPYC™ 9004 Processors",
    "vendor": "AMD",
    "versions": [
      {
        "status": "unaffected",
        "version": "GenoaPI 1.0.0.B"
      }
    ]
  }
]