CVE-2022-23818 Other in 3rd Gen AMD EPYC™

High 7.5 Published 9 May 2023 Updated 28 Jan 2025

Insufficient input validation in AMD EPYC firmware allows potential loss of SEV-SNP guest memory integrity.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-23818?

CVE-2022-23818 is a high-severity vulnerability in Amd Epyc 72f3 Firmware, published on 9 May 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Insufficient input validation on the model specific register: VM_HSAVE_PA may potentially lead to loss of SEV-SNP guest memory integrity.

Weakness: CWE-20

Which versions are affected by CVE-2022-23818?

It affects 23 products.

Products include Amd Epyc 72f3 Firmware, Amd Epyc 7313 Firmware, Amd Epyc 7313p Firmware, Amd Epyc 7343 Firmware, Amd Epyc 7373x Firmware, Amd Epyc 73f3 Firmware and 17 more.

How do I fix CVE-2022-23818?

No fix has been published for CVE-2022-23818 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-23818 being exploited?

There is no known exploitation of CVE-2022-23818 in the wild and no public exploit code.

All Amd Epyc 72f3 Firmware vulnerabilities

Sources

Also known as GHSA-9r25-9gf4-fwwr.