CVE-2023-31342

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Improper input validation in the SMM handler may allow a privileged attacker to overwrite SMRAM, potentially leading to arbitrary code execution.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-1220

Affected software

No affected versions have been published.

Timeline

Published
Feb 11, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2023

CVE-2023-313437.5Improper input validation in the SMM handler may allow a privileged attacker to overwrite SMRAM, potentially leading to arbitrary code execuCVE-2023-313457.5Improper input validation in the SMM handler may allow a privileged attacker to overwrite SMRAM, potentially leading to arbitrary code execuCVE-2023-313466.0Failure to initialize memory in SEV Firmware may allow a privileged attacker to access stale data from other guests.CVE-2023-313474.9Due to a code bug in Secure_TSC, SEV firmware may allow an attacker with high privileges to cause a guest to observe an incorrect TSC when SCVE-2023-313487.8A DLL hijacking vulnerability in AMD μProf could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code CVE-2023-313497.8Incorrect default permissions in the AMD μProf installation directory could allow an attacker to achieve privilege escalation, potentially rCVE-2023-31356.1The Mailtree Log Mail plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and includinCVE-2023-313515.3Improper restriction of operations in the IOMMU could allow a malicious hypervisor to access guest private memory resulting in loss of integCVE-2023-313526.0A bug in the SEV firmware may allow an attacker with privileges to read unencrypted memory, potentially resulting in loss of guest private dCVE-2023-313556.0Improper restriction of write operations in SNP firmware could allow a malicious hypervisor to overwrite a guest's UMC seed potentially alloCVE-2023-313564.4Incomplete system memory cleanup in SEV firmware could allow a privileged attacker to corrupt guest private memory, potentially resulting inCVE-2023-313587.8A DLL hijacking vulnerability in the AMD Manageability API could allow an attacker to achieve privilege escalation, potentially resulting in
CVE-2023-31342: High severity, CVSS 7.5 | Vulnix