CVE-2023-31339

MediumCVSS 5.8/10Last modified Jun 17, 2026

Description

Improper input validation in ARM® Trusted Firmware used in AMD’s Zynq™ UltraScale+™) MPSoC/RFSoC may allow a privileged attacker to perform out of bound reads, potentially resulting in data leakage and denial of service.

Metrics

CVSS 3.1 5.8/10CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-20 CWE-125

Affected software

No affected versions have been published.

Timeline

Published: Aug 13, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-31346.1The Forminator WordPress plugin before 1.24.4 does not properly escape values that are being reflected inside form fields that use pre-popul CVE-2023-313415.5Insufficient validation of the Input Output Control (IOCTL) input buffer in AMD μProf may allow an authenticated attacker to cause an out-of CVE-2023-313427.5Improper input validation in the SMM handler may allow a privileged attacker to overwrite SMRAM, potentially leading to arbitrary code execu CVE-2023-313437.5Improper input validation in the SMM handler may allow a privileged attacker to overwrite SMRAM, potentially leading to arbitrary code execu CVE-2023-313457.5Improper input validation in the SMM handler may allow a privileged attacker to overwrite SMRAM, potentially leading to arbitrary code execu CVE-2023-313466.0Failure to initialize memory in SEV Firmware may allow a privileged attacker to access stale data from other guests.CVE-2023-313474.9Due to a code bug in Secure_TSC, SEV firmware may allow an attacker with high privileges to cause a guest to observe an incorrect TSC when S CVE-2023-313487.8A DLL hijacking vulnerability in AMD μProf could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code CVE-2023-313497.8Incorrect default permissions in the AMD μProf installation directory could allow an attacker to achieve privilege escalation, potentially r CVE-2023-31356.1The Mailtree Log Mail plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and includin CVE-2023-313515.3Improper restriction of operations in the IOMMU could allow a malicious hypervisor to access guest private memory resulting in loss of integ CVE-2023-313526.0A bug in the SEV firmware may allow an attacker with privileges to read unencrypted memory, potentially resulting in loss of guest private d