PT-2023-5036 · Amd · Cpmdisplayfeaturesmm

Published 2023-08-08 · Updated 2023-08-21 · CVE-2023-20555

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AMD CpmDisplayFeatureSmm (affected versions not specified)

Description The issue is related to insufficient input validation in CpmDisplayFeatureSmm, which may allow an attacker to corrupt SMM memory by overwriting an arbitrary bit in an attacker-controlled pointer, potentially leading to arbitrary code execution in SMM. This can be described as a buffer overflow vulnerability in the memory of AMD processor microcode.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

BDU:2023-05579

CVE-2023-20555

Affected Products

Cpmdisplayfeaturesmm

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-20555 · Security Note
• https://bdu.fstec.ru/vul/2023-05579 · Security Note
• https://osv.dev/vulnerability/CVE-2023-20555 · Vendor Advisory
• https://amd.com/en/corporate/product-security/bulletin/AMD-SB-4003 · Vendor Advisory
• https://t.me/cibsecurity/68056 · Telegram Post
• https://twitter.com/CVEnew/status/1688962017028149256 · Twitter Post