CVE-2022-23820 Memory corruption in 3rd Gen AMD EPYC™ Processors
An attacker can corrupt SMRAM via invalid SMM communication buffers, potentially leading to arbitrary code execution on affected AMD processors.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-23820?
CVE-2022-23820 is a high-severity memory corruption vulnerability in 3rd Gen AMD EPYC™ Processors, published on 14 Nov 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Failure to validate the AMD SMM communication buffer may allow an attacker to corrupt the SMRAM potentially leading to arbitrary code execution.
Weakness: CWE-20
Which versions are affected by CVE-2022-23820?
It affects 105 products.
Products include Amd Athlon 3015ce Firmware, Amd Athlon 3015e Firmware, Amd Ryzen 3 3100 Firmware, Amd Ryzen 3 3300u Firmware, Amd Ryzen 3 3300x Firmware, Amd Ryzen 3 3350u Firmware and 99 more.
How do I fix CVE-2022-23820?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2022-23820 being exploited?
There is no known exploitation of CVE-2022-23820 in the wild and no public exploit code.
Other vulnerabilities in 3rd Gen AMD EPYC™ Processors
Sources
Also known as GHSA-9fmg-2fcx-q3vf.