CVE-2023-20521 Race condition in 1st Gen AMD EPYC™ Processors
An attacker with physical access can exploit a race condition in the ASP Bootloader to tamper with SPI ROM records, causing data leakage or denial of service.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-20521?
CVE-2023-20521 is a low-severity vulnerability in Amd Epyc 7232p Firmware, published on 14 Nov 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
TOCTOU in the ASP Bootloader may allow an attacker with physical access to tamper with SPI ROM records after memory content verification, potentially leading to loss of confidentiality or a denial of service.
Weakness: CWE-367
Which versions are affected by CVE-2023-20521?
It affects 93 products.
Products include Amd Amd 3015ce Firmware, Amd Amd 3015e Firmware, Amd Athlon Gold 3150g Firmware, Amd Athlon Gold Pro 3150g Firmware, Amd Athlon Gold Pro 3150ge Firmware, Amd Athlon Pro 300ge Firmware and 87 more.
How do I fix CVE-2023-20521?
Apply the vendor's patch.
Is CVE-2023-20521 being exploited?
There is no known exploitation of CVE-2023-20521 in the wild and no public exploit code.
Other vulnerabilities in Amd Epyc 7232p Firmware
- CVE-2021-26365 Information disclosure in Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics “Pollock”
- CVE-2020-12930 Privilege escalation in AMD Radeon RX 5000 Series & PRO W5000 Series
- CVE-2020-12931 Privilege escalation in AMD Radeon RX 5000 Series & PRO W5000 Series
- CVE-2021-26392 Memory corruption in AMD Radeon RX 5000 Series & PRO W5000 Series
- CVE-2021-26354 Memory corruption in 2nd Gen AMD EPYC™ Processors
Sources
Also known as GHSA-7r55-mp9r-c8pj.