CVE-2023-31315

hw: amd: SMM Lock Bypass

Published Aug 9, 2024 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Description
Improper validation in a model specific register (MSR) could allow a malicious program with ring0 access to modify SMM configuration while SMI lock is enabled, potentially leading to arbitrary code execution.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2023-35626 Improper validation in a model specific register (MSR) could allow a malicious program with ring0 access to modify SMM configuration while SMI lock is enabled, potentially leading to arbitrary code execution.
Ubuntu USN Ubuntu USN USN-7077-1 AMD Microcode vulnerability
History
Type Values Removed Values Added
Metrics epss

{'score': 0.00212}

epss

{'score': 0.00217}

Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:9
cpe:/o:redhat:rhel_eus:9.2
Type Values Removed Values Added
First Time appeared Redhat enterprise Linux
CPEs cpe:/o:redhat:enterprise_linux:8
Vendors & Products Redhat enterprise Linux
Type Values Removed Values Added
First Time appeared Redhat rhel Eus
CPEs cpe:/o:redhat:rhel_eus:8.8
Vendors & Products Redhat rhel Eus
Type Values Removed Values Added
First Time appeared Redhat
Redhat rhel Aus
Redhat rhel E4s
Redhat rhel Els
CPEs cpe:/o:redhat:rhel_aus:7.7
cpe:/o:redhat:rhel_e4s:9.0
cpe:/o:redhat:rhel_els:7
Vendors & Products Redhat
Redhat rhel Aus
Redhat rhel E4s
Redhat rhel Els
Type Values Removed Values Added
Weaknesses CWE-94
Type Values Removed Values Added
Metrics threat_severity

Moderate

threat_severity

Important

Type Values Removed Values Added
Description Improper validation in a model specific register (MSR) could allow a malicious program with ring0 access to modify SMM configuration while SMI lock is enabled, potentially leading to arbitrary code execution.
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H'}

Weaknesses

Sources

Status
PUBLISHED
Assigner
AMD
Published
Updated
Sep 12, 2024, 12:56 PM
Reserved
Apr 27, 2023, 3:25 PM
Status
Deferred
Published
Aug 12, 2024, 1:38 PM
Modified
Jun 17, 2026, 5:56 AM
Severity
Important
Public date
Aug 9, 2024, 12:00 AM