> CVE-2023-20578 [HIGH]

« BACK_TO_HOME
PUBLISHED
2024-08-13 17:15
MODIFIED
2025-03-18 20:15
CVSS_SCORE V3
7.5
EPSS (Prob. Exploit)
0.12%
Top 98.4%
DATA SOURCES:
NVD 🔗 2025-10-18 CVE PROJECT 🔗 2026-01-19 FIRST EPSS 🔗 2026-11-08

> DESCRIPTION

A TOCTOU (Time-Of-Check-Time-Of-Use) in SMM may allow an attacker with ring0 privileges and access to the BIOS menu or UEFI shell to modify the communications buffer potentially resulting in arbitrary code execution.

> AFFECTED_PRODUCTS

AMD - Epyc 7001 Firmware
< naplespi_1.0.0.k
AMD - Epyc 7232p Firmware
< romepi_1.0.0.g
AMD - Epyc 7251 Firmware
< naplespi_1.0.0.k
AMD - Epyc 7252 Firmware
< romepi_1.0.0.g
AMD - Epyc 7261 Firmware
< naplespi_1.0.0.k
AMD - Epyc 7262 Firmware
< romepi_1.0.0.g
AMD - Epyc 7272 Firmware
< romepi_1.0.0.g
AMD - Epyc 7281 Firmware
< naplespi_1.0.0.k
AMD - Epyc 7282 Firmware
< romepi_1.0.0.g
AMD - Epyc 72f3 Firmware
< milanpi_1.0.0.5
AMD - Epyc 7301 Firmware
< naplespi_1.0.0.k
AMD - Epyc 7302 Firmware
< romepi_1.0.0.g
AMD - Epyc 7302p Firmware
< romepi_1.0.0.g
AMD - Epyc 7313 Firmware
< milanpi_1.0.0.5
AMD - Epyc 7313p Firmware
< milanpi_1.0.0.5
AMD - Epyc 7343 Firmware
< milanpi_1.0.0.5
AMD - Epyc 7351 Firmware
< naplespi_1.0.0.k
AMD - Epyc 7351p Firmware
< naplespi_1.0.0.k
AMD - Epyc 7352 Firmware
< romepi_1.0.0.g
AMD - Epyc 7371 Firmware
< naplespi_1.0.0.k
AMD - Epyc 73f3 Firmware
< milanpi_1.0.0.5
AMD - Epyc 7401 Firmware
< naplespi_1.0.0.k
AMD - Epyc 7401p Firmware
< naplespi_1.0.0.k
AMD - Epyc 7402 Firmware
< romepi_1.0.0.g
AMD - Epyc 7402p Firmware
< romepi_1.0.0.g
AMD - Epyc 7413 Firmware
< milanpi_1.0.0.5
AMD - Epyc 7443 Firmware
< milanpi_1.0.0.5
AMD - Epyc 7443p Firmware
< milanpi_1.0.0.5
AMD - Epyc 7451 Firmware
< naplespi_1.0.0.k
AMD - Epyc 7452 Firmware
< romepi_1.0.0.g
AMD - Epyc 7453 Firmware
< milanpi_1.0.0.5
AMD - Epyc 74f3 Firmware
< milanpi_1.0.0.5
AMD - Epyc 7501 Firmware
< naplespi_1.0.0.k
AMD - Epyc 7502 Firmware
< romepi_1.0.0.g
AMD - Epyc 7502p Firmware
< romepi_1.0.0.g
AMD - Epyc 7513 Firmware
< milanpi_1.0.0.5
AMD - Epyc 7532 Firmware
< romepi_1.0.0.g
AMD - Epyc 7542 Firmware
< romepi_1.0.0.g
AMD - Epyc 7543 Firmware
< milanpi_1.0.0.5
AMD - Epyc 7543p Firmware
< milanpi_1.0.0.5
AMD - Epyc 7551 Firmware
< naplespi_1.0.0.k
AMD - Epyc 7551p Firmware
< naplespi_1.0.0.k
AMD - Epyc 7552 Firmware
< romepi_1.0.0.g
AMD - Epyc 75f3 Firmware
< milanpi_1.0.0.5
AMD - Epyc 7601 Firmware
< naplespi_1.0.0.k
AMD - Epyc 7642 Firmware
< romepi_1.0.0.g
AMD - Epyc 7643 Firmware
< milanpi_1.0.0.5
AMD - Epyc 7662 Firmware
< romepi_1.0.0.g
AMD - Epyc 7663 Firmware
< milanpi_1.0.0.5
AMD - Epyc 7702 Firmware
< romepi_1.0.0.g
AMD - Epyc 7702p Firmware
< romepi_1.0.0.g
AMD - Epyc 7713 Firmware
< milanpi_1.0.0.5
AMD - Epyc 7713p Firmware
< milanpi_1.0.0.5
AMD - Epyc 7742 Firmware
< romepi_1.0.0.g
AMD - Epyc 7763 Firmware
< milanpi_1.0.0.5
AMD - Epyc 7f32 Firmware
< romepi_1.0.0.g
AMD - Epyc 7f52 Firmware
< romepi_1.0.0.g
AMD - Epyc 7f72 Firmware
< romepi_1.0.0.g
AMD - Epyc 7h12 Firmware
< romepi_1.0.0.g
AMD - Epyc 7773x Firmware
< milanpi_1.0.0.5
AMD - Epyc 7473x Firmware
< milanpi_1.0.0.5
AMD - Epyc 7573x Firmware
< milanpi_1.0.0.5
AMD - Epyc 7373x Firmware
< milanpi_1.0.0.5
AMD - Epyc 7203 Firmware
< milanpi_1.0.0.5
AMD - Epyc 7203p Firmware
< milanpi_1.0.0.5
AMD - Epyc 7303 Firmware
< milanpi_1.0.0.5
AMD - Epyc 7303p Firmware
< milanpi_1.0.0.5
AMD - Epyc 7643p Firmware
< milanpi_1.0.0.5
AMD - Epyc 7663p Firmware
< milanpi_1.0.0.5
AMD - Epyc 8024pn Firmware
< genoapi_1.0.0.2
AMD - Epyc 8024p Firmware
< genoapi_1.0.0.2
AMD - Epyc 8124pn Firmware
< genoapi_1.0.0.2
AMD - Epyc 8124p Firmware
< genoapi_1.0.0.2
AMD - Epyc 8224pn Firmware
< genoapi_1.0.0.2
AMD - Epyc 8224p Firmware
< genoapi_1.0.0.2
AMD - Epyc 8324pn Firmware
< genoapi_1.0.0.2
AMD - Epyc 8324p Firmware
< genoapi_1.0.0.2
AMD - Epyc 8434pn Firmware
< genoapi_1.0.0.2
AMD - Epyc 8434p Firmware
< genoapi_1.0.0.2
AMD - Epyc 8534pn Firmware
< genoapi_1.0.0.2
AMD - Epyc 8534p Firmware
< genoapi_1.0.0.2
AMD - Epyc 9734 Firmware
< genoapi_1.0.0.2
AMD - Epyc 9754s Firmware
< genoapi_1.0.0.2
AMD - Epyc 9754 Firmware
< genoapi_1.0.0.2
AMD - Epyc 9184x Firmware
< genoapi_1.0.0.2
AMD - Epyc 9384x Firmware
< genoapi_1.0.0.2
AMD - Epyc 9684x Firmware
< genoapi_1.0.0.2
AMD - Epyc 9124 Firmware
< genoapi_1.0.0.2
AMD - Epyc 9174f Firmware
< genoapi_1.0.0.2
AMD - Epyc 9224 Firmware
< genoapi_1.0.0.2
AMD - Epyc 9254 Firmware
< genoapi_1.0.0.2
AMD - Epyc 9274f Firmware
< genoapi_1.0.0.2
AMD - Epyc 9334 Firmware
< genoapi_1.0.0.2
AMD - Epyc 9354 Firmware
< genoapi_1.0.0.2
AMD - Epyc 9354p Firmware
< genoapi_1.0.0.2
AMD - Epyc 9374f Firmware
< genoapi_1.0.0.2
AMD - Epyc 9454 Firmware
< genoapi_1.0.0.2
AMD - Epyc 9454p Firmware
< genoapi_1.0.0.2
AMD - Epyc 9474f Firmware
< genoapi_1.0.0.2
AMD - Epyc 9534 Firmware
< genoapi_1.0.0.2
AMD - Epyc 9554 Firmware
< genoapi_1.0.0.2
AMD - Epyc 9554p Firmware
< genoapi_1.0.0.2
AMD - Epyc 9634 Firmware
< genoapi_1.0.0.2
AMD - Epyc 9654 Firmware
< genoapi_1.0.0.2
AMD - Epyc 9654p Firmware
< genoapi_1.0.0.2

> CVSS V3 METRICS

CVSS_VECTOR
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

> MÉTRIQUES CVSS DÉTAILLÉES

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Métrique Valeur Interprétation
AV (Vecteur d'Attaque)
Attack Vector
Local (L)
Exploit nécessite un accès local au système
AC (Complexité d'Attaque)
Attack Complexity
High (H)
Conditions spécifiques doivent être réunies pour exploiter
PR (Privilèges Requis)
Privileges Required
High (H)
Authentifié avec privilèges administratifs
UI (Interaction Utilisateur)
User Interaction
None (N)
Aucune interaction utilisateur nécessaire
S (Périmètre)
Scope
Changed (C)
Impact s'étend au-delà du composant compromis
C (Impact Confidentialité)
Confidentiality Impact
High (H)
Divulgation totale d'informations
I (Impact Intégrité)
Integrity Impact
High (H)
Modification totale des données possible
A (Impact Disponibilité)
Availability Impact
High (H)
Interruption totale du service possible

> RÉSUMÉ DES IMPACTS

Confidentialité
High
Divulgation totale d'informations
Intégrité
High
Modification totale des données possible
Disponibilité
High
Interruption totale du service possible

> HISTORIQUE DES MODIFICATIONS

Première apparition
13/08/2024 17:15
Source: NVD
📊 ENRICHISSEMENT 18/10/2025 14:47
CVEPROJECT
Champ modifié: CVE Project
Ancienne valeur:
Non
Nouvelle valeur:
Oui
Total des modifications: 1 Dernière mise à jour: 1 year ago
« BACK_TO_HOME