Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.4

AMD EPYC, Instinct MI300A, Ryzen 3000 may execute attacker code

CVE-2023-20577 · published 2 months ago
Summary

AMD 2nd‑, 3rd‑, and 4th‑generation EPYC servers, Instinct MI300A accelerators, and Ryzen 3000 desktop CPUs contain a memory‑overflow bug in their system‑management code. If an attacker already has a way to write to the computer’s flash firmware, this bug can let them run any program they choose with full system privileges. Install the latest firmware updates from AMD and restrict any access that could modify the flash memory.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
amd 2nd gen amd epyc™ processors All versions
amd 3rd gen amd epyc™ processors All versions
amd 4th gen amd epyc™ processors All versions
amd amd instinct™ mi300a All versions
amd amd ryzen™ 3000 series desktop processors All versions
amd amd ryzen™ 5000 series desktop processors All versions
amd amd ryzen™ 5000 series desktop processors with radeon™ graphics All versions
amd amd ryzen™ 7000 series processors All versions
amd amd athlon™ 3000 series desktop processors with radeon™ graphics All versions
amd amd ryzen™ 4000 series desktop processors with radeon™ graphics All versions
amd amd ryzen™ threadripper™ 3000 series processors All versions
amd amd ryzen™ threadripper™ pro 3000wx series processors All versions
amd amd ryzen™ threadripper™ pro 5000wx processors All versions
amd amd athlon™ 3000 series mobile processors with radeon™ graphics All versions
amd amd ryzen™ 3000 series mobile processor with radeon™ graphics All versions
amd amd ryzen™ 4000 series mobile processors with radeon™ graphics All versions
amd amd ryzen™ 5000 series mobile processors with radeon™ graphics All versions
amd amd ryzen™ 7020 series processors with radeon™ graphics All versions
amd amd ryzen™ 6000 series processors with radeon™ graphics All versions
amd amd ryzen™ 7035 series processors with radeon™ graphics All versions
amd amd ryzen™ 5000 series processors with radeon™ graphics All versions
amd amd ryzen™ 3000 series processors with radeon™ graphics All versions
amd amd ryzen™ 7040 series processors with radeon™ graphics All versions
amd amd ryzen™ 7045 series mobile processors All versions
amd amd epyc™ embedded 3000 All versions
amd amd epyc™ embedded 7002 All versions
amd amd epyc™ embedded 7003 All versions
amd amd epyc™ embedded 9003 All versions
amd amd ryzen™ embedded r1000 All versions
amd amd ryzen™ embedded r2000 All versions
amd amd ryzen™ embedded 5000 All versions
amd amd ryzen™ embedded v1000 All versions
amd amd ryzen™ embedded v2000 All versions
amd amd ryzen™ embedded v3000 All versions
Original advisory text
A heap overflow in SMM module may allow an attacker with access to a second vulnerability that enables writing to SPI flash, potentially resulting in arbitrary code execution.
A heap overflow in SMM module may allow an attacker with access to a second vulnerability that enables writing to SPI flash, potentially resulting in arbitrary code execution.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
7.4 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-121Stack-based Buffer Overflow
Timeline
Published2 Sep 2026
Updated3 Nov 2026
First seen2 Sep 2026
Sources
CVE-2023-20577 · NVD
CVE-2023-20577 · MITRE
Track software like this
Free during beta