CVE-2023-20577
Summary
| CVE | CVE-2023-20577 |
|---|---|
| State | PUBLISHED |
| Assigner | AMD |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-09-02 20:17:34 UTC |
| Updated | 2026-09-02 20:17:34 UTC |
| Description | A heap overflow in SMM module may allow an attacker with access to a second vulnerability that enables writing to SPI flash, potentially resulting in arbitrary code execution. |
Risk And Classification
Primary CVSS: v3.1 7.4 HIGH from [email protected]
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Problem Types: CWE-121 | CWE-121 CWE-121 Stack-based buffer overflow
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Secondary | 7.4 | HIGH | CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | CNA | CVSS | 7.4 | HIGH | CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
CVSS v3.1 Breakdown
Attack Vector
LocalAttack Complexity
HighPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
HighAvailability
HighCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | AMD | 2nd Gen AMD EPYC Processors | unaffected RomePI 1.0.0.H | Not specified |
| CNA | AMD | 3rd Gen AMD EPYC Processors | unaffected MilanPI 1.0.0.C | Not specified |
| CNA | AMD | 4th Gen AMD EPYC Processors | unaffected GenoaPI 1.0.0.8 | Not specified |
| CNA | AMD | AMD Instinct MI300A | unaffected MI300 SR5 PI 1.0.0.1 | Not specified |
| CNA | AMD | AMD Ryzen 3000 Series Desktop Processors | unaffected ComboAM4v2 1.2.0.B | Not specified |
| CNA | AMD | AMD Ryzen 3000 Series Desktop Processors | unaffected ComboAM4 1.0.0.B | Not specified |
| CNA | AMD | AMD Ryzen 5000 Series Desktop Processors | unaffected ComboAM4v2 1.2.0.B | Not specified |
| CNA | AMD | AMD Ryzen 5000 Series Desktop Processors With Radeon Graphics | unaffected ComboAM4v2 1.2.0.B | Not specified |
| CNA | AMD | AMD Ryzen 7000 Series Processors | unaffected ComboAM5 1.0.0.7b | Not specified |
| CNA | AMD | AMD Athlon 3000 Series Desktop Processors With Radeon Graphics | unaffected ComboAM4v2 1.2.0.B | Not specified |
| CNA | AMD | AMD Athlon 3000 Series Desktop Processors With Radeon Graphics | unaffected ComboAM4 1.0.0.B | Not specified |
| CNA | AMD | AMD Ryzen 4000 Series Desktop Processors With Radeon Graphics | unaffected ComboAM4v2 1.2.0.B | Not specified |
| CNA | AMD | AMD Ryzen Threadripper 3000 Series Processors | unaffected CastlePeakPI-SP3r3 1.0.0.A | Not specified |
| CNA | AMD | AMD Ryzen Threadripper PRO 3000WX Series Processors | unaffected ChagallWSPI-sWRX8 1.0.0.7 | Not specified |
| CNA | AMD | AMD Ryzen Threadripper PRO 3000WX Series Processors | unaffected CastlePeakWSPI-sWRX8 1.0.0.C | Not specified |
| CNA | AMD | AMD Ryzen Threadripper PRO 5000WX Processors | unaffected ChagallWSPI-sWRX8 1.0.0.7 | Not specified |
| CNA | AMD | AMD Athlon 3000 Series Mobile Processors With Radeon Graphics | unaffected PicassoPI-FP5 1.0.1.0 | Not specified |
| CNA | AMD | AMD Athlon 3000 Series Mobile Processors With Radeon Graphics | unaffected PollockPI-FT5 1.0.0.6 | Not specified |
| CNA | AMD | AMD Ryzen 3000 Series Mobile Processor With Radeon Graphics | unaffected PicassoPI-FP5 1.0.1.0 | Not specified |
| CNA | AMD | AMD Ryzen 4000 Series Mobile Processors With Radeon Graphics | unaffected RenoirPI-FP6 1.0.0.D | Not specified |
| CNA | AMD | AMD Ryzen 5000 Series Mobile Processors With Radeon Graphics | unaffected CezannePI-FP6 1.0.0.F | Not specified |
| CNA | AMD | AMD Ryzen 5000 Series Mobile Processors With Radeon Graphics | unaffected CezannePI-FP6 1.0.0.F | Not specified |
| CNA | AMD | AMD Ryzen 7020 Series Processors With Radeon Graphics | unaffected MendocinoPI-FT6 1.0.0.6 | Not specified |
| CNA | AMD | AMD Ryzen 6000 Series Processors With Radeon Graphics | unaffected RembrandtPI-FP7 1.0.0.9b | Not specified |
| CNA | AMD | AMD Ryzen 7035 Series Processors With Radeon Graphics | unaffected RembrandtPI-FP7 1.0.0.9b | Not specified |
| CNA | AMD | AMD Ryzen 5000 Series Processors With Radeon Graphics | unaffected CezannePI-FP6 1.0.0.F | Not specified |
| CNA | AMD | AMD Ryzen 3000 Series Processors With Radeon Graphics | unaffected CezannePI-FP6 1.0.0.F | Not specified |
| CNA | AMD | AMD Ryzen 7040 Series Processors With Radeon Graphics | unaffected PhoenixPI-FP8-FP7 1.0.0.2 | Not specified |
| CNA | AMD | AMD Ryzen 7045 Series Mobile Processors | unaffected DragonRangeFL1PI 1.0.0.3a | Not specified |
| CNA | AMD | AMD EPYC Embedded 3000 | unaffected Snowyowl PI 1.1.0.B | Not specified |
| CNA | AMD | AMD EPYC Embedded 7002 | unaffected EmbRomePI-SP3 1.0.0.B | Not specified |
| CNA | AMD | AMD EPYC Embedded 7003 | unaffected EmbMilanPI-SP3 1.0.0.8 | Not specified |
| CNA | AMD | AMD EPYC Embedded 9003 | unaffected EmbGenoaPI-SP5 1.0.0.3 | Not specified |
| CNA | AMD | AMD Ryzen Embedded R1000 | unaffected EmbeddedPI-FP5 1.2.0.A | Not specified |
| CNA | AMD | AMD Ryzen Embedded R2000 | unaffected EmbeddedPI-FP5 1.0.0.2 | Not specified |
| CNA | AMD | AMD Ryzen Embedded 5000 | unaffected EmbAM4PI 1.0.0.4 | Not specified |
| CNA | AMD | AMD Ryzen Embedded V1000 | unaffected EmbeddedPI-FP5 1.2.0.A | Not specified |
| CNA | AMD | AMD Ryzen Embedded V2000 | unaffected EmbeddedPI-FP6 1.0.0.9 | Not specified |
| CNA | AMD | AMD Ryzen Embedded V3000 | unaffected EmbeddedPI-FP7r2 1.0.0.8 | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| www.amd.com/en/resources/product-security/bulletin/amd-sb-7009.html | [email protected] | www.amd.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.