AMD Zen Processors Affected by 4 High-Severity Vulnerabilities

Published by

teaser
AMD has disclosed four "high-severity" vulnerabilities affecting Zen 1-4 processors. The vulnerabilities, detailed in security bulletin AMD-SB-7009, impact a wide range of systems including servers, desktops, workstations, HEDT, mobile, and embedded platforms. The vulnerabilities, all categorized as "High" risk, are rooted in the dual serial peripheral interface (SPI), presenting potential avenues for denial-of-service attacks and remote code execution.

Here's a concise overview of the four vulnerabilities:

  1. CVE-2023-20576: Insufficient authenticity of AGESA verification data may permit unauthorized updates to SPI ROM data, potentially resulting in denial of service or privilege escalation.

  2. CVE-2023-20577: A heap overflow bit in the SMM module enables an attacker to exploit a secondary vulnerability, allowing unauthorized write access to SPI flash memory, facilitating arbitrary code execution.

  3. CVE-2023-20579: Inadequate access control in the AMD SPI protection function enables exploitation by users with Ring0 privileged access, potentially compromising integrity and availability.

  4. CVE-2023-20587: Inappropriate access control in System Management Mode (SMM) allows unauthorized access to SPI flash memory, facilitating arbitrary code execution.

Users of Ryzen 3000 series desktop CPUs, 4000 series mobile APUs, embedded V2000 chips, or V3000 systems should remain vigilant, as not all issues affecting these product generations have been patched. AMD plans to release updates later this month to address vulnerabilities in 4000 series APUs, followed by a BIOS update in March 2024 for 3000 series CPUs and a fix for embedded products in April.

CPU generationFixed minimum versionOnline date
1st Gen AMD EPYCNaplesPI 1.0.0.K2023-Apr-27
2nd Gen AMD EPYCRomePI 1.0.0.H2023-Nov-07
3rd Gen AMD EPYCMilanPI 1.0.0.C2023-Dec-18
4th Gen AMD EPYCGenoaAPI 1.0.0.82023-Jun-09
Ryzen 3000 DesktopComboAM4 1.0.0.B2024-Mar
Ryzen 5000 DesktopComboAM4v2 1.2.0.B2023-Aug-25
Ryzen 5000 Desktop w/ RadeonComboAM4v2PI 1.2.0.C2024-Feb-07
Ryzen 7000 DesktopComboAM5 1.0.8.02023-Aug-29
Ryzen 3000 Desktop w/ RadeonComboAM4 1.0.0.B2024-Mar
Ryzen 4000 Desktop w/ RadeonComboAM4v2PI 1.2.0.C2024-Feb-07
Ryzen Threadripper 3000CastlePeakPI-SP3r3 1.0.0.A2023-Nov-21
Ryzen Threadripper Pro 3000WXChagallWSPI-sWRX8 1.0.0.72024-Jan-11
Ryzen Threadripper Pro 5000WXChagallWSPI-sWRX8 1.0.0.72024-Jan-11
Athlon 3000 Mobile w/ RadeonPollockPI-FT5 1.0.0.62023-Oct-26
Ryzen 3000 Mobile w/ RadeonPicassoPI-FP5 1.0.1.02023-May-31
Ryzen 4000 Mobile w/ RadeonRenoirPI-FP6 1.0.0.D2024-Feb
Ryzen 5000 Mobile w/ RadeonCezannePI-FP6 1.0.1.02024-Jan-25
Ryzen 7020 w/ RadeonMendocinoPI-FT6 1.0.0.62024-Jan-03
Ryzen 6000 w/ RadeonRembrandtPI-FP7 1.0.0.A2023-Dec-28
Ryzen 7035 w/ RadeonRembrandtPI-FP7 1.0.0.A2023-Dec-28
Ryzen 5000 w/ RadeonCezannePI-FP6 1.0.1.02024-Jan-25
Ryzen 3000 w/ RadeonCezannePI-FP6 1.0.1.02024-Jan-25
Ryzen 7040 w/ RadeonPhoenixPI-FP8-FP7 1.1.0.02023-Oct-06
Ryzen 7045 MobileDragonRangeFL1PI 1.0.0.3b2023-Aug-30
EyPC Embedded 3000Snowyowl PI 1.1.0.B2023-Dec-15
Epyc Embedded 7002EmbRomePI-SP3 1.0.0.B2023-Dec-15
Epyc Embedded 7003EmbMilanPI-SP3 1.0.0.82024-Jan-15
Epyc Embedded 9003EmbGenoaPI-SP5 1.0.0.32023-Sep-15
Ryzen Embedded R1000EmbeddedPI-FP5 1.2.0.A2023-Jul-31
Ryzen Embedded R2000EmbeddedPI-FP5 1.0.0.22023-Jul-31
Ryzen Embedded 5000EmbAM4PI 1.0.0.42023-Sep-22
Ryzen Embedded V1000EmbeddedPI-FP5 1.2.0.A2023-Jul-31
Ryzen Embedded V2000EmbeddedPI-FP6 1.0.0.92024-Apr
Ryzen Embedded V3000EmbeddedPI-FP7r2 1.0.0.92024-Apr

Here  the link address of AMD’s official announcement . Interested users can read it more in depth.

Share this content
Twitter Facebook Reddit WhatsApp Email Print