CVE-2023-20563

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Insufficient protections in System Management Mode (SMM) code may allow an attacker to potentially enable escalation of privilege via local access.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269

Affected software

No affected versions have been published.

Timeline

Published
Nov 14, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-205646.7Insufficient validation in the IOCTL (Input Output Control) input buffer in AMD Ryzen™ Master may permit a privileged attacker to perform meCVE-2023-205657.8Insufficient protections in System Management Mode (SMM) code may allow an attacker to potentially enable escalation of privilege via local CVE-2023-205667.5Improper address validation in ASP with SNP enabled may potentially allow an attacker to compromise guest memory integrity.CVE-2023-205676.7Improper signature verification of RadeonTM RX Vega M Graphics driver for Windows may allow an attacker with admin privileges to launch AMDSCVE-2023-205686.7Improper signature verification of RadeonTM RX Vega M Graphics driver for Windows may allow an attacker with admin privileges to launch RadeCVE-2023-205694.7A side channel vulnerability on some of the AMD CPUs may allow an attacker to influence the return address prediction. This may result in spCVE-2023-20576.1A vulnerability was found in EyouCms 1.5.4. It has been classified as problematic. Affected is an unknown function of the file login.php?m=aCVE-2023-205703.3Insufficient verification of data authenticity in the configuration state machine may allow a local attacker to potentially load arbitrary bCVE-2023-205718.1A race condition in System Management Mode (SMM) code may allow an attacker using a compromised user space to leverage CVE-2018-8897 potentiCVE-2023-205725.6An observable timing discrepancy in the ASP could allow a privileged attacker to perform a brute-force attack against the hash message autheCVE-2023-205733.2A privileged attacker can prevent delivery of debug exceptions to SEV-SNP guests potentially resulting in guests not receiving expected debuCVE-2023-205756.5A potential power side-channel vulnerability in some AMD processors may allow an authenticated attacker to use the power reporting functiona