CVE-2023-20578

State: Published
Severity: 7.5 High
Published: Aug 13, 2024
Updated: Mar 18, 2025
Reserved: Oct 27, 2022

Description

A TOCTOU (Time-Of-Check-Time-Of-Use) in SMM may allow an attacker with ring0 privileges and access to the BIOS menu or UEFI shell to modify the communications buffer potentially resulting in arbitrary code execution.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H	AMD

Weaknesses

CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition

Affected Products

Product	Versions
AMD EPYC™ 7001 ProcessorsAMD	NaplesPI 1.0.0.KNot affected
AMD EPYC™ 7002 ProcessorsAMD	RomePI 1.0.0.GNot affected
AMD EPYC™ 7003 ProcessorsAMD	MilanPI 1.0.0.BNot affected
AMD EPYC™ 9004 ProcessorsAMD	GenoaPI 1.0.0.2Not affected
AMD Ryzen™ 7000 Series Desktop ProcessorsAMD	ComboAM5 1.0.0.1Not affected
AMD Ryzen™ Threadripper™ PRO 5000WX ProcessorsAMD	ChagallWSPI-sWRX8 1.0.0.7Not affected
AMD Ryzen™ 7020 Series Processors with Radeon™ GraphicsAMD	MendocinoPI-FT6 1.0.0.0Not affected
AMD Ryzen™ 6000 Series Processors with Radeon™ GraphicsAMD	RembrandtPI-FP7 1.0.0.9bNot affected
AMD Ryzen™ 7035 Series Processors with Radeon™ GraphicsAMD	RembrandtPI-FP7 1.0.0.9bNot affected
AMD EPYC™ Embedded 3000AMD	SnowyOwl PI 1.1.0.ANot affected
AMD EPYC™ Embedded 7002AMD	EmbRomePI-SP3 1.0.0.ANot affected
AMD EPYC™ Embedded 7003AMD	EmbMilanPI-SP3 1.0.0.7Not affected
AMD EPYC™ Embedded 9003AMD	EmbGenoaPI-SP5 1.0.0.0Not affected
AMD Ryzen™ Embedded 7000AMD	EmbeddedAM5PI 1.0.0.0Not affected
AMD RyzenTM Embedded V3000AMD	EmbeddedPI-FP7r2 1.0.0.8Not affected

References

https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3003.htmlvendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.