CVE-2022-23821 Privilege escalation in AMD Ryzen™ Embedded 5000
An attacker can exploit improper access control in System Management Mode to write to SPI ROM, potentially achieving arbitrary code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-23821?
CVE-2022-23821 is a critical vulnerability in AMD Ryzen™ Embedded 5000, published on 14 Nov 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Improper access control in System Management Mode (SMM) may allow an attacker to write to SPI ROM potentially leading to arbitrary code execution.
Which versions are affected by CVE-2022-23821?
It affects 108 products.
Products include Amd Athlon 3015ce Firmware, Amd Athlon 3015e Firmware, Amd Ryzen 3 3100 Firmware, Amd Ryzen 3 3200u Firmware, Amd Ryzen 3 3250c Firmware, Amd Ryzen 3 3250u Firmware and 102 more.
How do I fix CVE-2022-23821?
No fix has been published for CVE-2022-23821 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-23821 being exploited?
There is no known exploitation of CVE-2022-23821 in the wild and no public exploit code.
Other vulnerabilities in AMD Ryzen™ Embedded 5000
Sources
Also known as GHSA-wrmf-3x8w-vcx2.