CVE-2023-31309

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

Improper validation in Power Management Firmware (PMFW) may allow an attacker with privileges to pass malformed workload arguments when exporting table data from SMU to DRAM potentially resulting in a loss of confidentiality and/or availability.

Metrics

CVSS 4.0 6.8/10CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-129

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
May 15, 2026
Last modified
Jun 17, 2026
NVD status
Awaiting Analysis

Related CVEs from 2023

CVE-2023-31314.3The MStore API WordPress plugin before 3.9.7 does not secure most of its AJAX actions by implementing privilege checks, nonce checks, or a cCVE-2023-313105.0Improper input validation in Power Management Firmware (PMFW) may allow an attacker with privileges to send a malformed input for the "set tCVE-2023-313137.2An unintended proxy or intermediary in the AMD power management firmware (PMFW) could allow a privileged attacker to send malformed messagesCVE-2023-313157.5Improper validation in a model specific register (MSR) could allow a malicious program with ring0 access to modify SMM configuration while SCVE-2023-313167.1Improperly preserved integrity of hardware configuration state during a power save/restore operation in the AMD Secure Processor (ASP) couldCVE-2023-313178.8Improper restriction of operations within the bounds of a memory buffer in the AMD secure processer (ASP) could allow an attacker to read orCVE-2023-31327.5The MainWP Child plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.4.1.1 due to insufCVE-2023-313207.5Improper input validation in the AMD RadeonTM Graphics display driver may allow an attacker to corrupt the display potentially resulting in CVE-2023-313228.7Type confusion in the ASP could allow an attacker to pass a malformed argument to the Reliability, Availability, and Serviceability trusted CVE-2023-313238.4Type confusion in the AMD Secure Processor (ASP) could allow an attacker to pass a malformed argument to the External Global Memory InterconCVE-2023-313247.8A Time-of-check time-of-use (TOCTOU) race condition in the AMD Secure Processor (ASP) could allow an attacker to modify External Global MemoCVE-2023-313257.2Improper isolation of shared resources on System-on-a-chip (SOC) could a privileged attacker to tamper with the contents of the PSP reserved