CVE-2023-31315
High
Description
Improper validation in a model specific register (MSR) could allow a malicious program with ring0 access to modify SMM configuration while SMI lock is enabled, potentially leading to arbitrary code execution.
SeverityHigh
CVSS7.5
Exploit probability—
Product3rd Gen AMD EPYC™ Processors
PublishedAug 12, 2024
First seenAug 12, 2024
Weakness typeCWE-94Code injection
How to fix
Update
- AMD 3rd Gen AMD EPYC™ ProcessorsMilan PI 1.0.0.D or later
- AMD 1st Gen AMD EPYC™ ProcessorsNaples PI 1.0.0.M or later
- AMD 2nd Gen AMD EPYC™ ProcessorsRome PI 1.0.0.J or later
- AMD AMD Ryzen™ 7000 Series Desktop ProcessorsComboAM5PI 1.2.0.1 or later
- AMD AMD Ryzen™ 4000 Series Desktop Processors with Radeon™ GraphicsComboAM4v2PI 1.2.0.cb or later
- AMD AMD Ryzen™ Threadripper™ 3000 Series ProcessorsCastlePeakPI-SP3r3 1.0.0.B or later
- AMD AMD Ryzen™ Threadripper™ PRO ProcessorsChagallWSPI-sWRX8 1.0.0.8 or later
- AMD AMD Ryzen™ 3000 Series Mobile Processor with Radeon™ GraphicsPicasso-FP5 1.0.1.2 or later
- AMD AMD Ryzen™ 7030 Series Mobile Processors with Radeon™ GraphicsCezannePI-FP6 or later
- AMD AMD Ryzen™ 7020 Series Processors with Radeon™ GraphicsMendocinoPI-FT6 1.0.0.7 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| AMD 3rd Gen AMD EPYC™ Processors | various ≤ v < Milan PI 1.0.0.D | Milan PI 1.0.0.D |
| AMD 1st Gen AMD EPYC™ Processors | various ≤ v < Naples PI 1.0.0.M | Naples PI 1.0.0.M |
| AMD 2nd Gen AMD EPYC™ Processors | various ≤ v < Rome PI 1.0.0.J | Rome PI 1.0.0.J |
| AMD 4th Gen AMD EPYC™ Processors | No range specified | — |
| AMD AMD EPYC™ Embedded 3000 | various | — |
| AMD AMD EPYC™ Embedded 7002 | various | — |
| AMD AMD EPYC™ Embedded 7003 | various | — |
| AMD AMD EPYC™ Embedded 9003 | No range specified | — |
| AMD AMD Ryzen™ Embedded R1000 | various | — |
| AMD AMD Ryzen™ Embedded R2000 | various | — |
| AMD AMD Ryzen™ Embedded 5000 | various | — |
| AMD AMD Ryzen™ Embedded 7000 | various | — |
| AMD AMD Ryzen™ Embedded V1000 | various | — |
| AMD AMD Ryzen™ Embedded V2000 | various | — |
| AMD AMD Ryzen™ Embedded V3000 | various | — |
| AMD AMD Ryzen™ 3000 Series Desktop Processors | various | — |
| AMD AMD Ryzen™ 5000 Series Desktop Processors | No range specified | — |
| AMD AMD Ryzen™ 5000 Series Desktop processor with Radeon™ Graphics | No range specified | — |
| AMD AMD Ryzen™ 7000 Series Desktop Processors | various ≤ v < ComboAM5PI 1.2.0.1 | ComboAM5PI 1.2.0.1 |
| AMD AMD Ryzen™ 4000 Series Desktop Processors with Radeon™ Graphics | various ≤ v < ComboAM4v2PI 1.2.0.cb | ComboAM4v2PI 1.2.0.cb |
| AMD AMD Ryzen™ Threadripper™ 3000 Series Processors | various ≤ v < CastlePeakPI-SP3r3 1.0.0.B | CastlePeakPI-SP3r3 1.0.0.B |
| AMD AMD Ryzen™ Threadripper™ PRO Processors | various ≤ v < ChagallWSPI-sWRX8 1.0.0.8 | ChagallWSPI-sWRX8 1.0.0.8 |
| AMD AMD Ryzen™ Threadripper™ PRO 3000WX Series Processors | No range specified | — |
| AMD AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics | No range specified | — |
| AMD AMD Ryzen™ 3000 Series Mobile Processor with Radeon™ Graphics | various ≤ v < Picasso-FP5 1.0.1.2 | Picasso-FP5 1.0.1.2 |
| AMD AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics | No range specified | — |
| AMD AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics | No range specified | — |
| AMD AMD Ryzen™ 7030 Series Mobile Processors with Radeon™ Graphics | various ≤ v < CezannePI-FP6 | CezannePI-FP6 |
| AMD AMD Ryzen™ 7040 Series Mobile Processors with Radeon™ Graphics | No range specified | — |
| AMD AMD Ryzen™ 7045 Series Mobile Processors | No range specified | — |
| AMD AMD Ryzen™ 6000 Series Processors with Radeon™ Graphics | No range specified | — |
| AMD AMD Ryzen™ 7020 Series Processors with Radeon™ Graphics | various ≤ v < MendocinoPI-FT6 1.0.0.7 | MendocinoPI-FT6 1.0.0.7 |
| AMD AMD Ryzen™ 7035 Series Processors with Radeon™ Graphics | No range specified | — |
| AMD AMD Ryzen™ 8000 Series Processors with Radeon™ Graphics | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.