PT-2023-1373 · Amd · Amd System Management Unit

Published 2023-01-10 · Updated 2023-01-20 · CVE-2023-20528

Positive Technologies (AI Summary)

CVSS v2.0

3.3

Low

Base vector

AV:A/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions AMD System Management Unit (SMU) (affected versions not specified)

Description The issue is related to insufficient input validation in the SMU, which may allow a physical attacker to exfiltrate SMU memory contents over the I2C bus, potentially leading to a loss of confidentiality. The vulnerability exists due to inadequate input validation in the System Management Unit (SMU) component of AMD processors, and its exploitation may allow a remote attacker to disclose protected information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2023-00720

CVE-2023-20528

Affected Products

Amd System Management Unit

References · 5

• https://osv.dev/vulnerability/CVE-2023-20528 · Vendor Advisory
• https://amd.com/en/corporate/product-security/bulletin/AMD-SB-1032 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-00720 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-20528 · Security Note
• https://support.lenovo.com/us/en/productsecurity/LEN-87730 · Note