CVE-2023-20576: AMD Ryzen™ 3000 Series Desktop Processors, логическа

Описание

Оригинално описание

Insufficient Verification of Data Authenticity in AGESA™ may allow an attacker to update SPI ROM data potentially resulting in denial of service or privilege escalation.

Засегнати продукти

• AMD AMD Ryzen™ 3000 Series Desktop Processors: ComboAM4v2 1.2.0.B
• AMD AMD Ryzen™ 5000 Series Desktop Processors: ComboAM4v2v 1.2.0.B
• AMD AMD Ryzen™ 5000 Series Desktop Processors with Radeon™ Graphics: ComboAM4v2 1.2.0.B
• AMD AMD Ryzen™ 7000 Series Processors: ComboAM5 1.0.0.7b
• AMD AMD Ryzen™ 4000 Series Desktop Processors with Radeon™ Graphics: ComboAM4v2 1.2.0.B
• AMD AMD Ryzen™ Threadripper™ PRO 5000WX Processors: ChagallWSPI-sWRX8 1.0.0.7
• AMD AMD Ryzen™ 7020 Series Processors with Radeon™ Graphics: MendocinoPI-FT6 1.0.0.6
• AMD AMD Ryzen™ 6000 Series Processors with Radeon™ Graphics: RembrandtPI-FP7 1.0.0.9b
• AMD AMD Ryzen™ 7035 Series Processors with Radeon™ Graphics: RembrandtPI-FP7 1.0.0.9b
• AMD AMD Ryzen™ 7040 Series Processors with Radeon™ Graphics: PhoenixPI-FP8-FP7 1.0.0.2
• AMD AMD Ryzen™ 7045 Series Mobile Processors: DragonRangeFL1PI 1.0.0.3a
• AMD AMD Ryzen™ Embedded 5000: EmbAM4PI 1.0.0.4
• AMD AMD Ryzen™ Embedded V3000: EmbeddedPI-FP7r2 1.0.0.8

Вид слабост

• CWE-345 Недостатъчна проверка на автентичността на данните

История

Други уязвимости в AMD AMD Ryzen™ 3000 Series Desktop Processors

• 6.9CVE-2026-43603
• 7.4CVE-2023-20577
• 5.6CVE-2023-20572
• 1.8CVE-2023-20540
• 7.1CVE-2021-46747

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2023-20576
• https://nvd.nist.gov/vuln/detail/CVE-2023-20576
• https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7009.html