PT-2024-12279 · Unknown+1 · Scp-Firmware+1

Published 2024-08-05 · Updated 2025-08-13 · CVE-2023-31355

Positive Technologies (AI Summary)

CVSS v3.1

6.0

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided descriptions.

Description The issue involves improper restriction of write operations in SNP firmware. This could allow a malicious hypervisor to overwrite a guest's UMC seed, potentially enabling the reading of memory from a decommissioned guest.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Buffer Overflow

Weakness Enumeration

CWE-787

CWE-119

Related Identifiers

BDU:2025-09858

CVE-2023-31355

Affected Products

Red Os

Scp-Firmware

References · 9

• 🔥 https://github.com/Freax13/cve-2023-31355-poc · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-31355 · Security Note
• https://osv.dev/vulnerability/CVE-2023-31355 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-09858 · Security Note
• https://https//www.amd.com/en/resources/product-security/bulletin/amd-sb-3011.html · Vendor Advisory
• https://t.me/cvedetector/2476 · Telegram Post
• https://t.me/cvenotify/89237 · Telegram Post
• https://redos.red-soft.ru/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-linux-firmware-13082025/?sphrase_id=1203948 · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-linux-firmware-13082025 · Note