CVE-2023-20579 Security feature bypass in AMD Ryzen™ 3000 Series Processors with Radeon™ Graphics
A local attacker with kernel privileges can bypass AMD SPI protections, compromising system integrity and availability.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-20579?
CVE-2023-20579 is a low-severity vulnerability in AMD Ryzen™ 3000 Series Processors with Radeon™ Graphics, published on 13 Feb 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Improper Access Control in the AMD SPI protection feature may allow a user with Ring0 (kernel mode) privileged access to bypass protections potentially resulting in loss of integrity and availability.
Weakness: CWE-284
Which versions are affected by CVE-2023-20579?
It affects 129 products.
Products include Amd Ryzen 3 3200u Firmware, Amd Ryzen 3 3250c Firmware, Amd Ryzen 3 3250u Firmware, Amd Ryzen 3 3300u Firmware, Amd Ryzen 3 3350u Firmware, Amd Ryzen 3 4300g Firmware and 123 more.
How do I fix CVE-2023-20579?
No fix has been published for CVE-2023-20579 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-20579 being exploited?
There is no known exploitation of CVE-2023-20579 in the wild and no public exploit code.
Other vulnerabilities in AMD Ryzen™ 3000 Series Processors with Radeon™ Graphics
Sources
Also known as GHSA-263h-mwf7-v6rq.