CVE-2023-20577

A heap overflow in SMM module may allow an attacker with access to a second vulnerability that enables writing to SPI flash, potentially resulting in arbitrary code execution.

CVSS v3 7.4 HIGH

7.4^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.4 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7009.html

Configurations

No configuration.

History

No history.

Information

Published : 2026-09-02 20:17

Updated : 2026-09-04 20:17

NVD link : CVE-2023-20577

Mitre link : CVE-2023-20577

CVE.ORG link : CVE-2023-20577

JSON object : View

Products Affected

No product.

CWE

CWE-121

Stack-based Buffer Overflow

{"id": "CVE-2023-20577", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-20577", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-09-03T03:56:43.507455Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@amd.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.4}]}, "affected": [{"source": "psirt@amd.com", "affectedData": [{"vendor": "AMD", "product": "2nd Gen AMD EPYC\u2122 Processors", "versions": [{"status": "unaffected", "version": "RomePI 1.0.0.H"}], "defaultStatus": "affected"}, {"vendor": "AMD", "product": "3rd Gen AMD EPYC\u2122 Processors", "versions": [{"status": "unaffected", "version": "MilanPI 1.0.0.C"}], "defaultStatus": "affected"}, {"vendor": "AMD", "product": "4th Gen AMD EPYC\u2122 Processors", "versions": [{"status": "unaffected", "version": "GenoaPI 1.0.0.8"}], "defaultStatus": "affected"}, {"vendor": "AMD", "product": "AMD Instinct\u2122 MI300A", "versions": [{"status": "unaffected", "version": "MI300 SR5 PI 1.0.0.1"}], "defaultStatus": "affected"}, {"vendor": "AMD", "product": "AMD Ryzen\u2122 3000 Series Desktop Processors", "versions": [{"status": "unaffected", "version": "ComboAM4v2 1.2.0.B"}, {"status": "unaffected", "version": "ComboAM4 1.0.0.B"}], "defaultStatus": "affected"}, {"vendor": "AMD", "product": "AMD Ryzen\u2122 5000 Series Desktop Processors", "versions": [{"status": "unaffected", "version": "ComboAM4v2 1.2.0.B"}], "defaultStatus": "affected"}, {"vendor": "AMD", "product": "AMD Ryzen\u2122 5000 Series Desktop Processors with Radeon\u2122 Graphics", "versions": [{"status": "unaffected", "version": "ComboAM4v2 1.2.0.B"}], "defaultStatus": "affected"}, {"vendor": "AMD", "product": "AMD Ryzen\u2122 7000 Series Processors", "versions": [{"status": "unaffected", "version": "ComboAM5 1.0.0.7b"}], "defaultStatus": "affected"}, {"vendor": "AMD", "product": "AMD Athlon\u2122 3000 Series Desktop Processors with Radeon\u2122 Graphics", "versions": [{"status": "unaffected", "version": "ComboAM4v2 1.2.0.B"}, {"status": "unaffected", "version": "ComboAM4 1.0.0.B"}], "defaultStatus": "affected"}, {"vendor": "AMD", "product": "AMD Ryzen\u2122 4000 Series Desktop Processors with Radeon\u2122 Graphics", "versions": [{"status": "unaffected", "version": "ComboAM4v2 1.2.0.B"}], "defaultStatus": "affected"}, {"vendor": "AMD", "product": "AMD Ryzen\u2122 Threadripper\u2122 3000 Series Processors", "versions": [{"status": "unaffected", "version": "CastlePeakPI-SP3r3 1.0.0.A"}], "defaultStatus": "affected"}, {"vendor": "AMD", "product": "AMD Ryzen\u2122 Threadripper\u2122 PRO 3000WX Series Processors", "versions": [{"status": "unaffected", "version": "ChagallWSPI-sWRX8 1.0.0.7"}, {"status": "unaffected", "version": "CastlePeakWSPI-sWRX8 1.0.0.C"}], "defaultStatus": "affected"}, {"vendor": "AMD", "product": "AMD Ryzen\u2122 Threadripper\u2122 PRO 5000WX Processors", "versions": [{"status": "unaffected", "version": "ChagallWSPI-sWRX8 1.0.0.7"}], "defaultStatus": "affected"}, {"vendor": "AMD", "product": "AMD Athlon\u2122 3000 Series Mobile Processors with Radeon\u2122 Graphics", "versions": [{"status": "unaffected", "version": "PicassoPI-FP5 1.0.1.0"}], "defaultStatus": "affected"}, {"vendor": "AMD", "product": "AMD Athlon\u2122 3000 Series Mobile Processors with Radeon\u2122 Graphics", "versions": [{"status": "unaffected", "version": "PollockPI-FT5 1.0.0.6"}], "defaultStatus": "affected"}, {"vendor": "AMD", "product": "AMD Ryzen\u2122 3000 Series Mobile Processor with Radeon\u2122 Graphics", "versions": [{"status": "unaffected", "version": "PicassoPI-FP5 1.0.1.0"}], "defaultStatus": "affected"}, {"vendor": "AMD", "product": "AMD Ryzen\u2122 4000 Series Mobile Processors with Radeon\u2122 Graphics", "versions": [{"status": "unaffected", "version": "RenoirPI-FP6 1.0.0.D"}], "defaultStatus": "affected"}, {"vendor": "AMD", "product": "AMD Ryzen\u2122 5000 Series Mobile Processors with Radeon\u2122 Graphics", "versions": [{"status": "unaffected", "version": "CezannePI-FP6 1.0.0.F"}], "defaultStatus": "affected"}, {"vendor": "AMD", "product": "AMD Ryzen\u2122 5000 Series Mobile Processors with Radeon\u2122 Graphics", "versions": [{"status": "unaffected", "version": "CezannePI-FP6 1.0.0.F"}], "defaultStatus": "affected"}, {"vendor": "AMD", "product": "AMD Ryzen\u2122 7020 Series Processors with Radeon\u2122 Graphics", "versions": [{"status": "unaffected", "version": "MendocinoPI-FT6 1.0.0.6"}], "defaultStatus": "affected"}, {"vendor": "AMD", "product": "AMD Ryzen\u2122 6000 Series Processors with Radeon\u2122 Graphics", "versions": [{"status": "unaffected", "version": "RembrandtPI-FP7 1.0.0.9b"}], "defaultStatus": "affected"}, {"vendor": "AMD", "product": "AMD Ryzen\u2122 7035 Series Processors with Radeon\u2122 Graphics", "versions": [{"status": "unaffected", "version": "RembrandtPI-FP7 1.0.0.9b"}], "defaultStatus": "affected"}, {"vendor": "AMD", "product": "AMD Ryzen\u2122 5000 Series Processors with Radeon\u2122 Graphics", "versions": [{"status": "unaffected", "version": "CezannePI-FP6 1.0.0.F"}], "defaultStatus": "affected"}, {"vendor": "AMD", "product": "AMD Ryzen\u2122 3000 Series Processors with Radeon\u2122 Graphics", "versions": [{"status": "unaffected", "version": "CezannePI-FP6 1.0.0.F"}], "defaultStatus": "affected"}, {"vendor": "AMD", "product": "AMD Ryzen\u2122 7040 Series Processors with Radeon\u2122 Graphics", "versions": [{"status": "unaffected", "version": "PhoenixPI-FP8-FP7 1.0.0.2"}], "defaultStatus": "affected"}, {"vendor": "AMD", "product": "AMD Ryzen\u2122 7045 Series Mobile Processors", "versions": [{"status": "unaffected", "version": "DragonRangeFL1PI 1.0.0.3a"}], "defaultStatus": "affected"}, {"vendor": "AMD", "product": "AMD EPYC\u2122 Embedded 3000", "versions": [{"status": "unaffected", "version": "Snowyowl PI 1.1.0.B"}], "defaultStatus": "affected"}, {"vendor": "AMD", "product": "AMD EPYC\u2122 Embedded 7002", "versions": [{"status": "unaffected", "version": "EmbRomePI-SP3 1.0.0.B"}], "defaultStatus": "affected"}, {"vendor": "AMD", "product": "AMD EPYC\u2122 Embedded 7003", "versions": [{"status": "unaffected", "version": "EmbMilanPI-SP3 1.0.0.8"}], "defaultStatus": "affected"}, {"vendor": "AMD", "product": "AMD EPYC\u2122 Embedded 9003", "versions": [{"status": "unaffected", "version": "EmbGenoaPI-SP5 1.0.0.3"}], "defaultStatus": "affected"}, {"vendor": "AMD", "product": "AMD Ryzen\u2122 Embedded R1000", "versions": [{"status": "unaffected", "version": "EmbeddedPI-FP5 1.2.0.A"}], "defaultStatus": "affected"}, {"vendor": "AMD", "product": "AMD Ryzen\u2122 Embedded R2000", "versions": [{"status": "unaffected", "version": "EmbeddedPI-FP5 1.0.0.2"}], "defaultStatus": "affected"}, {"vendor": "AMD", "product": "AMD Ryzen\u2122 Embedded 5000", "versions": [{"status": "unaffected", "version": "EmbAM4PI 1.0.0.4"}], "defaultStatus": "affected"}, {"vendor": "AMD", "product": "AMD Ryzen\u2122 Embedded V1000", "versions": [{"status": "unaffected", "version": "EmbeddedPI-FP5 1.2.0.A"}], "defaultStatus": "affected"}, {"vendor": "AMD", "product": "AMD Ryzen\u2122 Embedded V2000", "versions": [{"status": "unaffected", "version": "EmbeddedPI-FP6 1.0.0.9"}], "defaultStatus": "affected"}, {"vendor": "AMD", "product": "AMD Ryzen\u2122 Embedded V3000", "versions": [{"status": "unaffected", "version": "EmbeddedPI-FP7r2 1.0.0.8"}], "defaultStatus": "affected"}]}], "published": "2026-09-02T20:17:34.093", "references": [{"url": "https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7009.html", "source": "psirt@amd.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "psirt@amd.com", "description": [{"lang": "en", "value": "CWE-121"}]}], "descriptions": [{"lang": "en", "value": "A heap overflow in SMM module may allow an attacker with access to a second vulnerability that enables writing to SPI flash, potentially resulting in arbitrary code execution."}], "lastModified": "2026-09-04T20:17:20.570", "sourceIdentifier": "psirt@amd.com"}