CVE-2022-23815

HighCVSS 8.2/10Last modified Jun 17, 2026

Description

Improper bounds checking in APCB firmware may allow an attacker to perform an out of bounds write, corrupting the APCB entry, potentially leading to arbitrary code execution.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
AMD	AMD Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics	various
AMD	AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics	—
AMD	AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics	—
AMD	AMD Ryzen™ 3000 Series Mobile Processor with Radeon™ Graphics	—
AMD	AMD RyzenTM Embedded R1000	—
AMD	AMD RyzenTM Embedded R2000	—
AMD	AMD RyzenTM Embedded V1000	—
amd	athlon_3000g	various
amd	ryzen_embedded_r1000	—
amd	ryzen_embedded_r2000	—
amd	ryzen_embedded_v1000	—

References

https://www.amd.com/en/resources/product-security/bulletin/amd-sb-4004.htmlVendor Advisory

Timeline

Published: Aug 13, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-238177.3Insufficient checking of memory buffer in AMD Secure Processor (ASP) Secure OS may allow an attacker with a malicious trusted application to CVE-2022-238187.5Insufficient input validation on the model specific register: VM_HSAVE_PA may potentially lead to loss of SEV-SNP guest memory integrity.CVE-2022-23824.3The Product Slider for WooCommerce WordPress plugin before 2.5.7 has flawed CSRF checks and lack authorisation in some of its AJAX actions, CVE-2022-238209.8Failure to validate the AMD SMM communication buffer may allow an attacker to corrupt the SMRAM potentially leading to arbitrary code execut CVE-2022-238219.8Improper access control in System Management Mode (SMM) may allow an attacker to write to SPI ROM potentially leading to arbitrary code exec CVE-2022-238226.8In this physical attack, an attacker may potentially exploit the Zynq-7000 SoC First Stage Boot Loader (FSBL) by bypassing authentication an CVE-2022-238236.5A potential vulnerability in some AMD processors using frequency scaling may allow an authenticated attacker to execute a timing attack to p CVE-2022-238245.5IBPB may not prevent return branch predictions from being specified by pre-IBPB branch targets leading to a potential information disclosure CVE-2022-238256.5Aliases in the branch predictor may cause some AMD processors to predict the wrong branch type potentially leading to information disclosure CVE-2022-238261.8A TOCTOU (Time-Of-Check to Time-Of-Use) in the graphics interface may allow an attacker to load registers repeatedly creating a race conditi CVE-2022-238298.2A potential weakness in AMD SPI protection features may allow a malicious attacker with Ring0 (kernel mode) access to bypass the native Syst CVE-2022-23836.1The Feed Them Social WordPress plugin before 3.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading t