Buffer overflow in AMD products - CVE-2023-20555

Vulnerability identifier: #VU79242

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-20555

CWE-ID: CWE-119

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error within the CpmDisplayFeatureSmm in SMM driver. A local user can trigger memory corruption and execute arbitrary code with elevated privileges.

AMD Ryzen 5000 Series Mobile processors with Radeon graphics
AMD Ryzen 7030 Series Mobile Processors
AMD Ryzen 7020 Series Mobile Processors
AMD Athlon 3000 Series Desktop Processors with Radeon Graphics
AMD Ryzen 4000 Series Desktop processors with Radeon graphics
AMD Ryzen 7000 Series Processors
AMD Athlon 3000 Series Mobile processors with Radeon Graphics
AMD Ryzen 3000 Series Mobile Processors with Radeon Graphics
AMD Ryzen 6000 Series Mobile Processors
AMD Ryzen 4000 Series Mobile processors with Radeon graphics
AMD Ryzen 3000 Series Desktop processors
AMD Ryzen 5000 Series Desktop Processors
AMD Ryzen 5000 Series Desktop processor with Radeon graphics
Vostro 15 3535
Vostro 14 3435
Inspiron 15 3535
Vostro 16 5635
Inspiron 14 5435
Inspiron 16 7635 2-in-1
Inspiron 14 7435 2-in-1
Inspiron 16 5635
Alienware Aurora R15 AMD
Alienware m15 R7 AMD
Alienware m17 R5 AMD
Dell G15 5525
Inspiron 5405
Inspiron 5505
Inspiron 14 7425 2-in-1
Vostro 5625
Inspiron 5425
Inspiron 15 3525
Vostro 3525
Vostro 3425
Inspiron 7405 2-in-1
Dell G15 5515
Alienware m15 Ryzen Edition R5
Inspiron 5415
Inspiron 3505
Inspiron 3515
Vostro 3405
Vostro 3515
Dell G5 5505
Inspiron 5515
Inspiron 7415 2-in-1
Vostro 5415
Vostro 5515
Alienware Aurora R10
Alienware Aurora Ryzen Edition R14

Install updates from vendor's website.

AMD Ryzen 5000 Series Mobile processors with Radeon graphics - update to CezannePI-FP6 1.0.0.E
AMD Ryzen 7030 Series Mobile Processors - update to CezannePI-FP6 1.0.0.E
AMD Ryzen 7020 Series Mobile Processors - update to MendocinoPI-FT6 1.0.0.5
AMD Athlon 3000 Series Desktop Processors with Radeon Graphics - addressed in versions ComboAM4V2 1.2.0.A, ComboAM4PIv1 1.0.0.A
AMD Ryzen 4000 Series Desktop processors with Radeon graphics - update to ComboAM4V2 1.2.0.A
AMD Ryzen 7000 Series Processors - update to ComboAM5 1.0.0.6
AMD Athlon 3000 Series Mobile processors with Radeon Graphics - addressed in versions PicassoPI-FP5 1.0.0.F, PollockPI-FT5 1.0.0.5
AMD Ryzen 3000 Series Mobile Processors with Radeon Graphics - update to PicassoPI-FP5 1.0.0.F
AMD Ryzen 6000 Series Mobile Processors - update to RembrandtPI-FP7 1.0.0.8
AMD Ryzen 4000 Series Mobile processors with Radeon graphics - update to RenoirPI-FP6 1.0.0.B
AMD Ryzen 3000 Series Desktop processors - addressed in versions ComboAM4V2 PI 1.2.0.A, ComboAM4 PI V1 1.0.0.A
AMD Ryzen 5000 Series Desktop Processors - update to ComboAM4 V2 PI 1.2.0.A
AMD Ryzen 5000 Series Desktop processor with Radeon graphics - update to ComboAM4v2 PI 1.2.0.A
Vostro 15 3535 - update to 1.6.0
Vostro 14 3435 - update to 1.6.0
Inspiron 15 3535 - update to 1.6.0
Vostro 16 5635 - update to 1.6.1
Inspiron 14 5435 - update to 1.6.1
Inspiron 16 7635 2-in-1 - update to 1.6.1
Inspiron 14 7435 2-in-1 - update to 1.6.1
Inspiron 16 5635 - update to 1.6.1
Alienware Aurora R15 AMD - update to 1.8.1
Alienware m15 R7 AMD - update to 1.11.1
Alienware m17 R5 AMD - update to 1.11.1
Dell G15 5525 - update to 1.11.1
Inspiron 5405 - update to 1.12.0
Inspiron 5505 - update to 1.12.0
Inspiron 14 7425 2-in-1 - update to 1.12.1
Vostro 5625 - update to 1.12.1
Inspiron 5425 - update to 1.12.1
Inspiron 15 3525 - update to 1.13.0
Vostro 3525 - update to 1.13.0
Vostro 3425 - update to 1.13.0
Inspiron 7405 2-in-1 - update to 1.13.0
Dell G15 5515 - update to 1.14.0
Alienware m15 Ryzen Edition R5 - update to 1.15.0
Inspiron 5415 - addressed in versions 1.15.0, 1.18.1
Inspiron 3505 - update to 1.15.1
Inspiron 3515 - update to 1.15.1
Vostro 3405 - update to 1.15.1
Vostro 3515 - update to 1.15.1
Dell G5 5505 - update to 1.16.0
Inspiron 5515 - update to 1.18.1
Inspiron 7415 2-in-1 - update to 1.18.1
Vostro 5415 - update to 1.18.1
Vostro 5515 - update to 1.18.1
Alienware Aurora R10 - update to 2.5.0
Alienware Aurora Ryzen Edition R14 - update to 2.13.0

• https://www.amd.com/en/resources/product-security/bulletin/amd-sb-4003.html

• Privilege escalation in SMM driver on AMD processors
• Dell update for AMD BIOS firmware