CVE-2023-20533 Denial of service in 2nd Gen AMD EPYC™ Processors
Insufficient DRAM address validation in AMD SMU allows attackers to cause denial of service via invalid memory access.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-20533?
CVE-2023-20533 is a medium-severity denial of service vulnerability in Amd Epyc 7232p Firmware, published on 14 Nov 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Insufficient DRAM address validation in System Management Unit (SMU) may allow an attacker to read/write from/to an invalid DRAM address, potentially resulting in denial-of-service.
Which versions are affected by CVE-2023-20533?
It affects 85 products.
Products include Amd Epyc 7203 Firmware, Amd Epyc 7203p Firmware, Amd Epyc 7232p Firmware, Amd Epyc 7252 Firmware, Amd Epyc 7262 Firmware, Amd Epyc 7272 Firmware and 79 more.
How do I fix CVE-2023-20533?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-20533 being exploited?
There is no known exploitation of CVE-2023-20533 in the wild and no public exploit code.
Other vulnerabilities in Amd Epyc 7232p Firmware
- CVE-2024-21980 Memory corruption in 3rd Gen AMD EPYC™ Processors
- CVE-2023-20591 Other in AMD EPYC™ 7003 Series Processors
- CVE-2023-31355 Memory corruption in 3rd Gen AMD EPYC™ Processors
- CVE-2024-21978 Information disclosure in 3rd Gen AMD EPYC™ Processors
- CVE-2023-31346 Information disclosure in 3rd Gen AMD EPYC™ Processors
Sources
Also known as GHSA-5pq2-w3x5-q9f2.