Permissions, Privileges, and Access Controls in AMD products - CVE-2023-31315

Vulnerability identifier: #VU96619

CSH Severity: Low

CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

CVE-ID: CVE-2023-31315

CWE-ID: CWE-264

Exploitation vector: Local access

Exploit availability: No public exploit available

Affected software:
AMD Ryzen Embedded V1000
4th Gen AMD EPYC Processors
3rd Gen AMD EPYC Processors
1st Gen AMD EPYC Processors
AMD Instinct MI300A
2nd Gen AMD EPYC Processors
AMD Ryzen Embedded V2000
AMD Ryzen 3000 Series Desktop processors
AMD Ryzen 7035 Series Processors with Radeon Graphics
AMD Ryzen 6000 Series Processors with Radeon Graphics
AMD Ryzen Threadripper 3000 Series Processors
AMD Ryzen Embedded V3000
AMD EPYC Embedded 7002
AMD Ryzen 4000 Series Mobile processors with Radeon graphics
AMD Ryzen Embedded 7000
AMD Ryzen 7045 Series Mobile Processors
AMD Ryzen Embedded R2000
AMD Ryzen Embedded 5000
AMD EPYC Embedded 9003
AMD Ryzen 7020 Series Processors with Radeon Graphics
AMD Ryzen Threadripper PRO processors
AMD Ryzen Threadripper PRO 3000WX Series Processors
AMD Athlon 3000 Series Mobile processors with Radeon Graphics
AMD EPYC Embedded 7003
AMD Ryzen 7030 Series Mobile Processors with Radeon Graphics
AMD Ryzen 5000 Series Processors with Radeon Graphics
AMD Ryzen 5000 Series Mobile processors with Radeon graphics
AMD Ryzen 3000 Series Mobile processor with Radeon graphics
AMD EPYC Embedded 3000
AMD Ryzen Threadripper 7000 Series Processors
AMD Ryzen 7040 Series Mobile Processors with Radeon Graphics
AMD Ryzen Series Mobile Processors with Radeon Graphics
AMD Ryzen Embedded R1000
AMD Ryzen 4000 Series Desktop processors with Radeon graphics
AMD Ryzen 5000 Series Desktop processor with Radeon graphics
AMD Ryzen 5000 Series Desktop Processors
AMD Ryzen 8000 Series Processors with Radeon Graphics
AMD Ryzen 7000 Series Desktop Processors
Cray EX255a
Inspiron 16 5645
Cray EX425
Inspiron 14 7445 2-in-1
Inspiron 14 5445
Dell G15 5535
Precision 7875 Tower
Inspiron 14 7435 2-in-1
Inspiron 14 5435
Inspiron 16 7635 2-in-1
Inspiron 16 5635
Vostro 16 5635
Precision Tower 7865
Alienware m16 R1 AMD
Alienware m18
Alienware Aurora R15 AMD
Vostro 14 3435
Vostro 15 3535
Inspiron 15 3535
Inspiron 14 7425 2-in-1
Inspiron 14 5425
Vostro 5625
Inspiron 16 5625
Alienware m15 R7 AMD
Alienware m17 R5 AMD
Dell G15 5525
Inspiron 5405
Inspiron 5505
Inspiron 7405 2-in-1
Inspiron 15 3525
Vostro 14 3425
Vostro 15 3525
Dell G15 5515
Alienware m15 Ryzen Edition R5
Dell G5 5505
Vostro 5515
Vostro 5415
Inspiron 5415
Inspiron 7415 2-in-1
Inspiron 5515
Inspiron 24 5415 All-in-One
Inspiron 3505
Vostro 3405
Inspiron 15 3515
Vostro 15 3515
HPE ProLiant DL325 Gen11 Server
HPE ProLiant DL345 Gen11 Server
HPE ProLiant DL365 Gen11 Server
HPE ProLiant DL385 Gen11 Server
Alienware Aurora R10
Alienware Aurora Ryzen Edition R14
HPE ProLiant XL225n Gen10 Plus 1U Node
HPE ProLiant DL325 Gen10 Plus v2 server
HPE ProLiant DL345 Gen10 Plus server
HPE ProLiant DL365 Gen10 Plus server
HPE ProLiant DL385 Gen10 Plus server
HPE ProLiant DL385 Gen10 Plus v2 server
HPE ProLiant DL325 Gen10 Plus server
HPE ProLiant DL325 Gen10 Server
HPE ProLiant DL385 Gen10 Server
HPE ProLiant XL645d Gen10 Plus
HPE ProLiant XL675d Gen10 Plus
SimpliVity 325 Gen 11
SimpliVity 325 Gen10 Plus
SimpliVity 325 Gen10
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Manager Proxy
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
openSUSE Leap Micro
Anolis OS
SUSE Enterprise Storage
Red Hat Enterprise Linux Server - AUS
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
SUSE Linux Enterprise Desktop 15 SP4 LTSS
SUSE Linux Enterprise Server 15 SP4 LTSS
Basesystem Module
openSUSE Leap
Ubuntu
openEuler
Fedora
RecoverPoint for Virtual Machines
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
amd64-microcode (Ubuntu package)
iwl5150-firmware
iwl5000-firmware
iwl6000-firmware
iwl3945-firmware
iwl2030-firmware
iwl2000-firmware
iwl6000g2a-firmware
iwl6000g2b-firmware
iwl135-firmware
iwl105-firmware
iwl7260-firmware
iwl3160-firmware
iwl1000-firmware
iwl100-firmware
iwl6050-firmware
iwl4965-firmware
linux-firmware (Red Hat package)
ucode-amd
kernel-firmware
linux-firmware
kernel-firmware-dpaa2
kernel-firmware-nvidia
kernel-firmware-bnx2
kernel-firmware-ueagle
kernel-firmware-serial
kernel-firmware-mediatek
kernel-firmware-radeon
kernel-firmware-bluetooth
kernel-firmware-prestera
kernel-firmware-platform
kernel-firmware-nfp
kernel-firmware-atheros
kernel-firmware-ath10k
kernel-firmware-ath11k
kernel-firmware-intel
kernel-firmware-usb-network
kernel-firmware-iwlwifi
kernel-firmware-mwifiex
kernel-firmware-network
kernel-firmware-amdgpu
kernel-firmware-all
kernel-firmware-qlogic
kernel-firmware-chelsio
kernel-firmware-media
kernel-firmware-ti
kernel-firmware-brcm
kernel-firmware-mellanox
kernel-firmware-i915
kernel-firmware-marvell
kernel-firmware-liquidio
kernel-firmware-realtek
kernel-firmware-sound
kernel-firmware-qcom
linux-firmware-ath
linux-firmware-ti-connectivity
linux-firmware-netronome
linux-firmware-mrvl
linux-firmware-mediatek
linux-firmware-libertas
linux-firmware-iwlwifi
linux-firmware-cypress
libertas-usb8388-olpc-firmware
libertas-usb8388-firmware
libertas-sd8787-firmware
libertas-sd8686-firmware
kernel-firmware-ath12k
Cray EX235n
Cray EX4252
IBM Power Hardware Management Console (HMC)
Cray EX235a
Storage Resource Manager
EMC Cloud Tiering Appliance
Dell EMC Storage Monitoring and Reporting (SMR)
IBM QRadar Network Packet Capture

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to improper validation in a model specific register (MSR). A malicious application with ring0 access can modify SMM configuration while SMI lock is enabled, potentially leading to arbitrary code execution.

Install updates from vendor's website.

• https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7014.html