Incomplete cleanup in 4th Gen AMD EPYC Processors - CVE-2023-20518

Vulnerability identifier: #VU97954

CSH Severity: Low

CVSS v4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-20518

CWE-ID: CWE-459

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to incomplete cleanup in the ASP. A local privileged user with access to the BIOS menu or UEFI shell can obtain the Master Encryption Key (MEK).

4th Gen AMD EPYC Processors
SimpliVity 325 Gen10 Plus
SimpliVity 325 Gen10
SimpliVity 325 Gen 11
HPE ProLiant DL345 Gen11 Server
HPE Gen11 BIOS
HPE ProLiant DL385 Gen11 Server
HPE ProLiant DL365 Gen11 Server
HPE ProLiant DL325 Gen11 Server
HPE ProLiant DL325 Gen10 Plus v2 server
HPE ProLiant DL345 Gen10 Plus server
HPE ProLiant DL365 Gen10 Plus server
HPE ProLiant DL385 Gen10 Plus server
HPE ProLiant DL385 Gen10 Plus v2 server
HPE ProLiant DL325 Gen10 Plus server
HPE Gen10 Plus BIOS
HPE ProLiant DL325 Gen10 Server
HPE ProLiant DL385 Gen10 Server
HPE Gen10 BIOS

Install updates from vendor's website.

4th Gen AMD EPYC Processors - update to GenoaPI 1.0.0.4
SimpliVity 325 Gen10 Plus - update to SVTSPGen10-2024_0731
SimpliVity 325 Gen10 - update to SVTSPGen10-2024_0731
SimpliVity 325 Gen 11 - update to SVTSPGen11-2024_0731
HPE ProLiant DL345 Gen11 Server - update to 1.58_01-04-2024
HPE Gen11 BIOS - update to 1.58_01-04-2024
HPE ProLiant DL385 Gen11 Server - update to 1.58_01-04-2024
HPE ProLiant DL365 Gen11 Server - update to 1.58_01-04-2024
HPE ProLiant DL325 Gen11 Server - update to 1.58_01-04-2024
HPE ProLiant DL325 Gen10 Plus v2 server - update to 2.84_08-17-2023
HPE ProLiant DL345 Gen10 Plus server - update to 2.84_08-17-2023
HPE ProLiant DL365 Gen10 Plus server - update to 2.84_08-17-2023
HPE ProLiant DL385 Gen10 Plus server - update to 2.84_08-17-2023
HPE ProLiant DL385 Gen10 Plus v2 server - update to 2.84_08-17-2023
HPE ProLiant DL325 Gen10 Plus server - update to 2.84_08-17-2023
HPE Gen10 Plus BIOS - update to 2.84_08-17-2023
HPE ProLiant DL325 Gen10 Server - update to 2.84_09-07-2023
HPE ProLiant DL385 Gen10 Server - update to 2.84_09-07-2023
HPE Gen10 BIOS - update to 2.84_09-07-2023

• https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3003.html

• Multiple vulnerabilities in AMD EPYC processors
• Multiple vulnerabilities in HPE ProLiant DL Servers with AMD EPYC processors
• HPE SimpliVity update for AMD EPYC firmware