CVE-2023-31345

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Improper input validation in the SMM handler may allow a privileged attacker to overwrite SMRAM, potentially leading to arbitrary code execution.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-1274

Affected software

Vendor	Product	Versions
AMD	AMD EPYC™ 7003 Processors	MilanPI 1.0.0.C
AMD	AMD EPYC™ 9004 Processors	—
AMD	AMD Instinct™ MI300A	—
AMD	AMD Ryzen™ 3000 Series Desktop Processors	—
AMD	AMD Ryzen™ 5000 Series Desktop Processors	—
AMD	AMD Ryzen™ 5000 Series Desktop Processor with Radeon™ Graphics	—
AMD	AMD Ryzen™ 7000 Series Desktop Processors	—
AMD	AMD Ryzen™ 4000 Series Desktop Processor with Radeon™ Graphics	—
AMD	AMD Ryzen™ 8000 Series Processor with Radeon™ Graphics	—
AMD	AMD Ryzen™ Threadripper™ PRO 5000WX- Series Desktop Processors	—
AMD	AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics	—
AMD	AMD Ryzen™ 3000 Series Mobile Processor with Radeon™ Graphics	—
AMD	AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics	—
AMD	AMD Ryzen™ 5000 Series Processors with Radeon™ Graphics	—
AMD	AMD Ryzen™ 7020 Series Processors with Radeon™ Graphics	—
AMD	AMD Ryzen™ 6000 Series Processor with Radeon™ Graphics	—
AMD	AMD Ryzen™ 7035 Series Processor with Radeon™ Graphics	—
AMD	AMD Ryzen™ 7040 Series Processors with Radeon™ Graphics	—
AMD	AMD Ryzen™ 7000 Series Mobile Processors	—
AMD	AMD EPYC™ Embedded 7003	—
AMD	AMD EPYC™ Embedded 9004	—
AMD	AMD Ryzen™ Embedded 5000	—
AMD	AMD Ryzen™ Embedded 7000	—
AMD	AMD Ryzen™ Embedded V2000	—
AMD	AMD Ryzen™ Embedded V3000	—

References

Timeline

Published: Feb 12, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2023

CVE-2023-313466.0Failure to initialize memory in SEV Firmware may allow a privileged attacker to access stale data from other guests.CVE-2023-313474.9Due to a code bug in Secure_TSC, SEV firmware may allow an attacker with high privileges to cause a guest to observe an incorrect TSC when S CVE-2023-313487.8A DLL hijacking vulnerability in AMD μProf could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code CVE-2023-313497.8Incorrect default permissions in the AMD μProf installation directory could allow an attacker to achieve privilege escalation, potentially r CVE-2023-31356.1The Mailtree Log Mail plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and includin CVE-2023-313515.3Improper restriction of operations in the IOMMU could allow a malicious hypervisor to access guest private memory resulting in loss of integ CVE-2023-313526.0A bug in the SEV firmware may allow an attacker with privileges to read unencrypted memory, potentially resulting in loss of guest private d CVE-2023-313556.0Improper restriction of write operations in SNP firmware could allow a malicious hypervisor to overwrite a guest's UMC seed potentially allo CVE-2023-313564.4Incomplete system memory cleanup in SEV firmware could allow a privileged attacker to corrupt guest private memory, potentially resulting in CVE-2023-313587.8A DLL hijacking vulnerability in the AMD Manageability API could allow an attacker to achieve privilege escalation, potentially resulting in CVE-2023-313597.8Incorrect default permissions in the AMD Manageability API could allow an attacker to achieve privilege escalation, potentially resulting in CVE-2023-31366.1The MailArchiver plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 2.