Lucene search

AMDVULNRICHMENT:CVE-2022-23829

HistoryJun 18, 2024 - 7:01 p.m.

CVE-2022-23829

2024-06-1819:01:24

AMD

github.com

amd

spi weakness

ring0 bypass

smm

rom protections

CVSS3

8.2

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

AI Score

8.1

Confidence

High

SSVC

Exploitation

none

Automatable

Technical Impact

total

JSON

A potential weakness in AMD SPI protection features may allow a malicious attacker with Ring0 (kernel mode) access to bypass the native System Management Mode (SMM) ROM protections.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:h:amd:ryzen_threadripper_pro_5945wx:-:*:*:*:*:*:*:*",
      "cpe:2.3:h:amd:ryzen_threadripper_pro_5955wx:-:*:*:*:*:*:*:*",
      "cpe:2.3:h:amd:ryzen_threadripper_pro_5965wx:-:*:*:*:*:*:*:*",
      "cpe:2.3:h:amd:ryzen_threadripper_pro_5975wx:-:*:*:*:*:*:*:*",
      "cpe:2.3:h:amd:ryzen_threadripper_pro_5995wx:-:*:*:*:*:*:*:*"
    ],
    "vendor": "amd",
    "product": "ryzen_threadripper_pro_5995wx",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "*",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "cpes": [
      "cpe:2.3:h:amd:ryzen_6600h:-:*:*:*:*:*:*:*",
      "cpe:2.3:h:amd:ryzen_6600hs:-:*:*:*:*:*:*:*",
      "cpe:2.3:h:amd:ryzen_6600u:-:*:*:*:*:*:*:*",
      "cpe:2.3:h:amd:ryzen_6800h:-:*:*:*:*:*:*:*",
      "cpe:2.3:h:amd:ryzen_6800hs:-:*:*:*:*:*:*:*",
      "cpe:2.3:h:amd:ryzen_6800u:-:*:*:*:*:*:*:*",
      "cpe:2.3:h:amd:ryzen_6900hs:-:*:*:*:*:*:*:*",
      "cpe:2.3:h:amd:ryzen_6900hx:-:*:*:*:*:*:*:*",
      "cpe:2.3:h:amd:ryzen_6980hs:-:*:*:*:*:*:*:*",
      "cpe:2.3:h:amd:ryzen_6980hx:-:*:*:*:*:*:*:*"
    ],
    "vendor": "amd",
    "product": "ryzen_6980hx",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "*",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  }
]

References

www.amd.com/en/resources/product-security/bulletin/amd-sb-1041.html

CVSS3

8.2

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

AI Score

8.1

Confidence

High

SSVC

Exploitation

none

Automatable

Technical Impact

total

JSON

Related for VULNRICHMENT:CVE-2022-23829