SMM lock bypass in AMD processors

1) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU96619

Risk: Low

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-31315

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to improper validation in a model specific register (MSR). A malicious application with ring0 access can modify SMM configuration while SMI lock is enabled, potentially leading to arbitrary code execution.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

AMD Ryzen Embedded V1000: All versions

1st Gen AMD EPYC Processors: before NaplesPI 1.0.0.M

2nd Gen AMD EPYC Processors: before RomePI 1.0.0.J

3rd Gen AMD EPYC Processors: before MilanPI 1.0.0.D

4th Gen AMD EPYC Processors: before GenoaPI 1.0.0.C

AMD Instinct MI300A: before PI1.0.0.2

AMD EPYC Embedded 3000: before 1.1.0.D

AMD EPYC Embedded 7002: before 1.0.0.C

AMD EPYC Embedded 7003: before 1.0.0.9

AMD EPYC Embedded 9003: before 1.0.0.7

AMD Ryzen Embedded R1000: before 1.2.0.D

AMD Ryzen Embedded R2000: before 1.0.0.4

AMD Ryzen Embedded 5000: before 1.0.0.6

AMD Ryzen Embedded 7000: before 1.0.0.2

AMD Ryzen Embedded V2000: before 1.0.0.A

AMD Ryzen Embedded V3000: before 1.0.0.B

AMD Ryzen 3000 Series Desktop processors: before 1.0.0ba

AMD Ryzen 5000 Series Desktop Processors: before 1.2.0.cb

AMD Ryzen 5000 Series Desktop processor with Radeon graphics: before 1.2.0.cb

AMD Ryzen 7000 Series Desktop Processors: before 1.2.0.1

AMD Ryzen 4000 Series Desktop processors with Radeon graphics: before 1.2.0.cb

AMD Ryzen 8000 Series Processors with Radeon Graphics: before 1.2.0.1

AMD Ryzen Threadripper 3000 Series Processors: before 1.0.0.B

AMD Ryzen Threadripper 7000 Series Processors: before 1.1.0.0f

AMD Ryzen Threadripper PRO processors: before 1.0.0.8

AMD Ryzen Threadripper PRO 3000WX Series Processors: before 1.0.0.8

AMD Athlon 3000 Series Mobile processors with Radeon Graphics: before 1.0.0.8

AMD Ryzen 3000 Series Mobile processor with Radeon graphics: before 1.0.1.2

AMD Ryzen 4000 Series Mobile processors with Radeon graphics: before 1.0.0.E

AMD Ryzen 5000 Series Mobile processors with Radeon graphics: before 1.0.1.1

AMD Ryzen 7020 Series Processors with Radeon Graphics: before 1.0.0.7

AMD Ryzen 6000 Series Processors with Radeon Graphics: before 1.0.0.B

AMD Ryzen 7035 Series Processors with Radeon Graphics: before 1.0.0.B

AMD Ryzen 5000 Series Processors with Radeon Graphics: before 1.0.1.1

AMD Ryzen 7030 Series Mobile Processors with Radeon Graphics: before 1.0.1.1

AMD Ryzen 7040 Series Mobile Processors with Radeon Graphics: before 1.1.0.3

AMD Ryzen Series Mobile Processors with Radeon Graphics: before 1.1.0.3

AMD Ryzen 7045 Series Mobile Processors: before 1.0.0.3e

CPE2.3

• cpe:2.3:h:amd:amd_ryzen_embedded_v1000:*:*:*:*:*:*:*:*
• cpe:2.3:h:amd:1st_gen_amd_epyc_processors:*:*:*:*:*:*:*:*
• cpe:2.3:h:amd:2nd_gen_amd_epyc_processors:*:*:*:*:*:*:*:*
• cpe:2.3:h:amd:3rd_gen_amd_epyc_processors:*:*:*:*:*:*:*:*
• cpe:2.3:h:amd:4th_gen_amd_epyc_processors:*:*:*:*:*:*:*:*
• cpe:2.3:h:amd:amd_instinct_mi300a:*:*:*:*:*:*:*:*
• cpe:2.3:h:amd:amd_epyc_embedded_3000:*:*:*:*:*:*:*:*
• cpe:2.3:h:amd:amd_epyc_embedded_7002:*:*:*:*:*:*:*:*
• cpe:2.3:h:amd:amd_epyc_embedded_7003:*:*:*:*:*:*:*:*
• cpe:2.3:h:amd:amd_epyc_embedded_9003:*:*:*:*:*:*:*:*
• cpe:2.3:h:amd:amd_ryzen_embedded_r1000:*:*:*:*:*:*:*:*
• cpe:2.3:h:amd:amd_ryzen_embedded_r2000:*:*:*:*:*:*:*:*
• cpe:2.3:h:amd:amd_ryzen_embedded_5000:*:*:*:*:*:*:*:*
• cpe:2.3:h:amd:amd_ryzen_embedded_7000:*:*:*:*:*:*:*:*
• cpe:2.3:h:amd:amd_ryzen_embedded_v2000:*:*:*:*:*:*:*:*
• cpe:2.3:h:amd:amd_ryzen_embedded_v3000:*:*:*:*:*:*:*:*
• cpe:2.3:h:amd:amd_ryzen_3000_series_desktop_processors:*:*:*:*:*:*:*:*
• cpe:2.3:h:amd:amd_ryzen_5000_series_desktop_processors:*:*:*:*:*:*:*:*
• cpe:2.3:h:amd:amd_ryzen_5000_series_desktop_processor_with_radeon_graphics:*:*:*:*:*:*:*:*
• cpe:2.3:h:amd:amd_ryzen_7000_series_desktop_processors:*:*:*:*:*:*:*:*
• cpe:2.3:h:amd:amd_ryzen_4000_series_desktop_processors_with_radeon_graphics:*:*:*:*:*:*:*:*
• cpe:2.3:h:amd:amd_ryzen_8000_series_processors_with_radeon_graphics:*:*:*:*:*:*:*:*
• cpe:2.3:h:amd:amd_ryzen_threadripper_3000_series_processors:*:*:*:*:*:*:*:*
• cpe:2.3:h:amd:amd_ryzen_threadripper_7000_series_processors:*:*:*:*:*:*:*:*
• cpe:2.3:h:amd:amd_ryzen_threadripper_pro_processors:*:*:*:*:*:*:*:*
• cpe:2.3:h:amd:amd_ryzen_threadripper_pro_3000wx_series_processors:*:*:*:*:*:*:*:*
• cpe:2.3:h:amd:amd_athlon_3000_series_mobile_processors_with_radeon_graphics:*:*:*:*:*:*:*:*
• cpe:2.3:h:amd:amd_ryzen_3000_series_mobile_processor_with_radeon_graphics:*:*:*:*:*:*:*:*
• cpe:2.3:h:amd:amd_ryzen_4000_series_mobile_processors_with_radeon_graphics:*:*:*:*:*:*:*:*
• cpe:2.3:h:amd:amd_ryzen_5000_series_mobile_processors_with_radeon_graphics:*:*:*:*:*:*:*:*
• cpe:2.3:h:amd:amd_ryzen_7020_series_processors_with_radeon_graphics:*:*:*:*:*:*:*:*
• cpe:2.3:h:amd:amd_ryzen_6000_series_processors_with_radeon_graphics:*:*:*:*:*:*:*:*
• cpe:2.3:h:amd:amd_ryzen_7035_series_processors_with_radeon_graphics:*:*:*:*:*:*:*:*
• cpe:2.3:h:amd:amd_ryzen_5000_series_processors_with_radeon_graphics:*:*:*:*:*:*:*:*
• cpe:2.3:h:amd:amd_ryzen_7030_series_mobile_processors_with_radeon_graphics:*:*:*:*:*:*:*:*
• cpe:2.3:h:amd:amd_ryzen_7040_series_mobile_processors_with_radeon_graphics:*:*:*:*:*:*:*:*
• cpe:2.3:h:amd:amd_ryzen_series_mobile_processors_with_radeon_graphics:*:*:*:*:*:*:*:*
• cpe:2.3:h:amd:amd_ryzen_7045_series_mobile_processors:*:*:*:*:*:*:*:*

External links

http://www.amd.com/en/resources/product-security/bulletin/amd-sb-7014.html

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.