CVE-2023-20596 Privilege escalation in AMD Ryzen™ 6000 Series Processors with Radeon™ Graphics "Rembrandt"
An attacker with a compromised SMI handler can exploit improper input validation in the SMM Supervisor to gain Ring0 access and execute arbitrary code.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-20596?
CVE-2023-20596 is a critical vulnerability in AMD Ryzen™ 6000 Series Processors with Radeon™ Graphics "Rembrandt", published on 14 Nov 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Improper input validation in the SMM Supervisor may allow an attacker with a compromised SMI handler to gain Ring0 access potentially leading to arbitrary code execution.
Which versions are affected by CVE-2023-20596?
It affects 64 products.
Products include Amd Ryzen 3 5125c Firmware, Amd Ryzen 3 5300g Firmware, Amd Ryzen 3 5300ge Firmware, Amd Ryzen 3 5400u Firmware, Amd Ryzen 3 5425u Firmware, Amd Ryzen 3 7335u Firmware and 58 more.
How do I fix CVE-2023-20596?
No fix has been published for CVE-2023-20596 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-20596 being exploited?
There is no known exploitation of CVE-2023-20596 in the wild and no public exploit code.
Sources
Also known as GHSA-r2mq-3mfq-2p2w.