CVE-2022-23820

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Failure to validate the AMD SMM communication buffer may allow an attacker to corrupt the SMRAM potentially leading to arbitrary code execution.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published
Nov 14, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-238219.8Improper access control in System Management Mode (SMM) may allow an attacker to write to SPI ROM potentially leading to arbitrary code execCVE-2022-238226.8In this physical attack, an attacker may potentially exploit the Zynq-7000 SoC First Stage Boot Loader (FSBL) by bypassing authentication anCVE-2022-238236.5A potential vulnerability in some AMD processors using frequency scaling may allow an authenticated attacker to execute a timing attack to pCVE-2022-238245.5IBPB may not prevent return branch predictions from being specified by pre-IBPB branch targets leading to a potential information disclosureCVE-2022-238256.5Aliases in the branch predictor may cause some AMD processors to predict the wrong branch type potentially leading to information disclosureCVE-2022-238261.8A TOCTOU (Time-Of-Check to Time-Of-Use) in the graphics interface may allow an attacker to load registers repeatedly creating a race conditiCVE-2022-238298.2A potential weakness in AMD SPI protection features may allow a malicious attacker with Ring0 (kernel mode) access to bypass the native SystCVE-2022-23836.1The Feed Them Social WordPress plugin before 3.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading tCVE-2022-238305.3SMM configuration may not be immutable, as intended, when SNP is enabled resulting in a potential limited loss of guest memory integrity.CVE-2022-238317.5Insufficient validation of the IOCTL input buffer in AMD μProf may allow an attacker to send an arbitrary buffer leading to a potential WindCVE-2022-238337.5An issue was discovered in MultiPartParser in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2. Passing certain inputs to mCVE-2022-238358.1The Visual Voice Mail (VVM) application through 2022-02-24 for Android allows persistent access if an attacker temporarily controls an appli
CVE-2022-23820: Critical severity, CVSS 9.8 | Vulnix