CVE-2023-31345
Published: 12 February 2025
Description
Improper input validation in the SMM handler may allow a privileged attacker to overwrite SMRAM, potentially leading to arbitrary code execution.
Security Summary
CVE-2023-31345 involves improper input validation in the SMM handler, which may allow a privileged attacker to overwrite SMRAM, potentially leading to arbitrary code execution. This vulnerability, associated with CWE-1274, affects AMD platforms, as documented in multiple AMD security bulletins.
Exploitation requires local access (AV:L), high attack complexity (AC:H), and high privileges (PR:H), with no user interaction (UI:N). A successful attack can achieve high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H) within a changed scope (S:C), yielding a CVSS v3.1 base score of 7.5.
AMD has published security bulletins, including AMD-SB-3009, AMD-SB-4008, and AMD-SB-5004, which detail mitigations and patches to address this issue. The vulnerability was published on 2025-02-12.
Details
- CWE(s)