#VU96619 Permissions, Privileges, and Access Controls in AMD products - CVE-2023-31315

Vulnerability identifier: #VU96619

Vulnerability risk: Low

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-31315

CWE-ID: CWE-264

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
AMD Ryzen Embedded V1000
Hardware solutions / Firmware
1st Gen AMD EPYC Processors
Hardware solutions / Firmware
2nd Gen AMD EPYC Processors
Hardware solutions / Firmware
3rd Gen AMD EPYC Processors
Hardware solutions / Firmware
4th Gen AMD EPYC Processors
Hardware solutions / Firmware
AMD Instinct MI300A
Hardware solutions / Firmware
AMD EPYC Embedded 3000
Hardware solutions / Firmware
AMD EPYC Embedded 7002
Hardware solutions / Firmware
AMD EPYC Embedded 7003
Hardware solutions / Firmware
AMD EPYC Embedded 9003
Hardware solutions / Firmware
AMD Ryzen Embedded R1000
Hardware solutions / Firmware
AMD Ryzen Embedded R2000
Hardware solutions / Firmware
AMD Ryzen Embedded 5000
Hardware solutions / Firmware
AMD Ryzen Embedded 7000
Hardware solutions / Firmware
AMD Ryzen Embedded V2000
Hardware solutions / Firmware
AMD Ryzen Embedded V3000
Hardware solutions / Firmware
AMD Ryzen 3000 Series Desktop processors
Hardware solutions / Firmware
AMD Ryzen 5000 Series Desktop Processors
Hardware solutions / Firmware
AMD Ryzen 5000 Series Desktop processor with Radeon graphics
Hardware solutions / Firmware
AMD Ryzen 7000 Series Desktop Processors
Hardware solutions / Firmware
AMD Ryzen 4000 Series Desktop processors with Radeon graphics
Hardware solutions / Firmware
AMD Ryzen 8000 Series Processors with Radeon Graphics
Hardware solutions / Firmware
AMD Ryzen Threadripper 3000 Series Processors
Hardware solutions / Firmware
AMD Ryzen Threadripper 7000 Series Processors
Hardware solutions / Firmware
AMD Ryzen Threadripper PRO processors
Hardware solutions / Firmware
AMD Ryzen Threadripper PRO 3000WX Series Processors
Hardware solutions / Firmware
AMD Athlon 3000 Series Mobile processors with Radeon Graphics
Hardware solutions / Firmware
AMD Ryzen 3000 Series Mobile processor with Radeon graphics
Hardware solutions / Firmware
AMD Ryzen 4000 Series Mobile processors with Radeon graphics
Hardware solutions / Firmware
AMD Ryzen 5000 Series Mobile processors with Radeon graphics
Hardware solutions / Firmware
AMD Ryzen 7020 Series Processors with Radeon Graphics
Hardware solutions / Firmware
AMD Ryzen 6000 Series Processors with Radeon Graphics
Hardware solutions / Firmware
AMD Ryzen 7035 Series Processors with Radeon Graphics
Hardware solutions / Firmware
AMD Ryzen 5000 Series Processors with Radeon Graphics
Hardware solutions / Firmware
AMD Ryzen 7030 Series Mobile Processors with Radeon Graphics
Hardware solutions / Firmware
AMD Ryzen 7040 Series Mobile Processors with Radeon Graphics
Hardware solutions / Firmware
AMD Ryzen Series Mobile Processors with Radeon Graphics
Hardware solutions / Firmware
AMD Ryzen 7045 Series Mobile Processors
Hardware solutions / Firmware

Vendor: AMD

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to improper validation in a model specific register (MSR). A malicious application with ring0 access can modify SMM configuration while SMI lock is enabled, potentially leading to arbitrary code execution.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

AMD Ryzen Embedded V1000: All versions

1st Gen AMD EPYC Processors: before NaplesPI 1.0.0.M

2nd Gen AMD EPYC Processors: before RomePI 1.0.0.J

3rd Gen AMD EPYC Processors: before MilanPI 1.0.0.D

4th Gen AMD EPYC Processors: before GenoaPI 1.0.0.C

AMD Instinct MI300A: before PI1.0.0.2

AMD EPYC Embedded 3000: before 1.1.0.D

AMD EPYC Embedded 7002: before 1.0.0.C

AMD EPYC Embedded 7003: before 1.0.0.9

AMD EPYC Embedded 9003: before 1.0.0.7

AMD Ryzen Embedded R1000: before 1.2.0.D

AMD Ryzen Embedded R2000: before 1.0.0.4

AMD Ryzen Embedded 5000: before 1.0.0.6

AMD Ryzen Embedded 7000: before 1.0.0.2

AMD Ryzen Embedded V2000: before 1.0.0.A

AMD Ryzen Embedded V3000: before 1.0.0.B

AMD Ryzen 3000 Series Desktop processors: before 1.0.0ba

AMD Ryzen 5000 Series Desktop Processors: before 1.2.0.cb

AMD Ryzen 5000 Series Desktop processor with Radeon graphics: before 1.2.0.cb

AMD Ryzen 7000 Series Desktop Processors: before 1.2.0.1

AMD Ryzen 4000 Series Desktop processors with Radeon graphics: before 1.2.0.cb

AMD Ryzen 8000 Series Processors with Radeon Graphics: before 1.2.0.1

AMD Ryzen Threadripper 3000 Series Processors: before 1.0.0.B

AMD Ryzen Threadripper 7000 Series Processors: before 1.1.0.0f

AMD Ryzen Threadripper PRO processors: before 1.0.0.8

AMD Ryzen Threadripper PRO 3000WX Series Processors: before 1.0.0.8

AMD Athlon 3000 Series Mobile processors with Radeon Graphics: before 1.0.0.8

AMD Ryzen 3000 Series Mobile processor with Radeon graphics: before 1.0.1.2

AMD Ryzen 4000 Series Mobile processors with Radeon graphics: before 1.0.0.E

AMD Ryzen 5000 Series Mobile processors with Radeon graphics: before 1.0.1.1

AMD Ryzen 7020 Series Processors with Radeon Graphics: before 1.0.0.7

AMD Ryzen 6000 Series Processors with Radeon Graphics: before 1.0.0.B

AMD Ryzen 7035 Series Processors with Radeon Graphics: before 1.0.0.B

AMD Ryzen 5000 Series Processors with Radeon Graphics: before 1.0.1.1

AMD Ryzen 7030 Series Mobile Processors with Radeon Graphics: before 1.0.1.1

AMD Ryzen 7040 Series Mobile Processors with Radeon Graphics: before 1.1.0.3

AMD Ryzen Series Mobile Processors with Radeon Graphics: before 1.1.0.3

AMD Ryzen 7045 Series Mobile Processors: before 1.0.0.3e

---

External links
https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7014.html

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.