CVE-2023-31315

State: Published
Severity: 7.5 High
Published: Aug 9, 2024
Updated: Sep 12, 2024
Reserved: Apr 27, 2023

Description

Improper validation in a model specific register (MSR) could allow a malicious program with ring0 access to modify SMM configuration while SMI lock is enabled, potentially leading to arbitrary code execution.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H	AMD
3.1	6.8 Medium	CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L	CISA-ADP

Weaknesses

CWE-94 Improper Control of Generation of Code ('Code Injection')

Affected Products

Product	Versions
3rd Gen AMD EPYC™ ProcessorsAMD	various to before Milan PI 1.0.0.DAffected
1st Gen AMD EPYC™ ProcessorsAMD	various to before Naples PI 1.0.0.MAffected
2nd Gen AMD EPYC™ ProcessorsAMD	various to before Rome PI 1.0.0.JAffected
4th Gen AMD EPYC™ ProcessorsAMD	various to before Genoa PI 1.0.0.CNot affected
AMD EPYC™ Embedded 3000AMD	variousAffected
AMD EPYC™ Embedded 7002AMD	variousAffected
AMD EPYC™ Embedded 7003AMD	variousAffected
AMD EPYC™ Embedded 9003AMD	various to before EmbGenoaPI 1.0.0.7Not affected
AMD Ryzen™ Embedded R1000AMD	variousAffected
AMD Ryzen™ Embedded R2000AMD	variousAffected
AMD Ryzen™ Embedded 5000AMD	variousAffected
AMD Ryzen™ Embedded 7000AMD	variousAffected
AMD Ryzen™ Embedded V1000AMD	variousAffected
AMD Ryzen™ Embedded V2000AMD	variousAffected
AMD Ryzen™ Embedded V3000AMD	variousAffected
AMD Ryzen™ 3000 Series Desktop ProcessorsAMD	variousAffected
AMD Ryzen™ 5000 Series Desktop ProcessorsAMD	various to before ComboAM4v2PI 1.2.0.cbNot affected
AMD Ryzen™ 5000 Series Desktop processor with Radeon™ GraphicsAMD	various to before ComboAM4v2PI 1.2.0.cbNot affected
AMD Ryzen™ 7000 Series Desktop ProcessorsAMD	various to before ComboAM5PI 1.2.0.1Affected
AMD Ryzen™ 4000 Series Desktop Processors with Radeon™ GraphicsAMD	various to before ComboAM4v2PI 1.2.0.cbAffected
AMD Ryzen™ Threadripper™ 3000 Series ProcessorsAMD	various to before CastlePeakPI-SP3r3 1.0.0.BAffected
AMD Ryzen™ Threadripper™ PRO ProcessorsAMD	various to before ChagallWSPI-sWRX8 1.0.0.8Affected various to before CastlePeakWSPI-sWRX8 1.0.0.DNot affected
AMD Ryzen™ Threadripper™ PRO 3000WX Series ProcessorsAMD	various to before ChagallWSPI-sWRX8 1.0.0.8Not affected
AMD Athlon™ 3000 Series Mobile Processors with Radeon™ GraphicsAMD	various to before Picasso-FP5 1.0.1.2Not affected various to before PollockPI-FT5 1.0.0.8Not affected
AMD Ryzen™ 3000 Series Mobile Processor with Radeon™ GraphicsAMD	various to before Picasso-FP5 1.0.1.2Affected
AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ GraphicsAMD	various to before RenoirPI-FP6 1.0.0.ENot affected
AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ GraphicsAMD	various to before CezannePI-FP6 1.0.1.1Not affected
AMD Ryzen™ 7030 Series Mobile Processors with Radeon™ GraphicsAMD	various to before CezannePI-FP6Affected
AMD Ryzen™ 7040 Series Mobile Processors with Radeon™ GraphicsAMD	various to before PhoenixPI-FP8-FP7 1.1.0.3Not affected
AMD Ryzen™ 7045 Series Mobile ProcessorsAMD	various to before DragonRangeFL1 1.0.0.3eNot affected
AMD Ryzen™ 6000 Series Processors with Radeon™ GraphicsAMD	various to before RembrandtPI-FP7 1.0.0.BNot affected
AMD Ryzen™ 7020 Series Processors with Radeon™ GraphicsAMD	various to before MendocinoPI-FT6 1.0.0.7Affected
AMD Ryzen™ 7035 Series Processors with Radeon™ GraphicsAMD	various to before RembrandtPI-FP7 1.0.0.BNot affected
AMD Ryzen™ 8000 Series Processors with Radeon™ GraphicsAMD	various to before ComboAM5PI 1.2.0.1Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.