1. Home
  2. CVE Database
  3. CVE-2023-20578
HIGH · 7.5

CVE-2023-20578

A TOCTOU (Time-Of-Check-Time-Of-Use) in SMM may allow an attacker with ring0 privileges and access to the BIOS menu or UEFI shell to modify the communications buffer potentially resulting in arbitrary...

Vulnerability Description

A TOCTOU (Time-Of-Check-Time-Of-Use) in SMM may allow an attacker with ring0 privileges and access to the BIOS menu or UEFI shell to modify the communications buffer potentially resulting in arbitrary code execution.

CVSS Score

7.5

HIGH

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
HIGH
User Interaction
NONE
Scope
CHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
AmdEpyc 8024Pn Firmware< genoapi_1.0.0.2
AmdEpyc 8024Pn-
AmdEpyc 8024P Firmware< genoapi_1.0.0.2
AmdEpyc 8024P-
AmdEpyc 8124Pn Firmware< genoapi_1.0.0.2
AmdEpyc 8124Pn-
AmdEpyc 8124P Firmware< genoapi_1.0.0.2
AmdEpyc 8124P-
AmdEpyc 8224Pn Firmware< genoapi_1.0.0.2
AmdEpyc 8224Pn-
AmdEpyc 8224P Firmware< genoapi_1.0.0.2
AmdEpyc 8224P-
AmdEpyc 8324Pn Firmware< genoapi_1.0.0.2
AmdEpyc 8324Pn-
AmdEpyc 8324P Firmware< genoapi_1.0.0.2
AmdEpyc 8324P-
AmdEpyc 8434Pn Firmware< genoapi_1.0.0.2
AmdEpyc 8434Pn-
AmdEpyc 8434P Firmware< genoapi_1.0.0.2
AmdEpyc 8434P-

Related Weaknesses (CWE)

CWE-367

References

FAQ

What is CVE-2023-20578?

CVE-2023-20578 is a vulnerability with a CVSS score of 7.5 (HIGH). A TOCTOU (Time-Of-Check-Time-Of-Use) in SMM may allow an attacker with ring0 privileges and access to the BIOS menu or UEFI shell to modify the communications buffer potentially resulting in arbitrary...

How severe is CVE-2023-20578?

CVE-2023-20578 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2023-20578?

Check the references section above for vendor advisories and patch information. Affected products include: Amd Epyc 8024Pn Firmware, Amd Epyc 8024Pn, Amd Epyc 8024P Firmware, Amd Epyc 8024P, Amd Epyc 8124Pn Firmware.