low3.3
CVE-2023-20521
TOCTOU in the ASP Bootloader may allow an attacker with physical access to tamper with SPI ROM records after memory content verification, potentially leading t…
Impact
TOCTOU in the ASP Bootloader may allow an attacker with physical access to tamper with SPI ROM records after memory content verification, potentially leading to loss of confidentiality or a denial of service.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Amd | Epyc 7001 Firmware | before naplespi_1.0.0.h |
| Amd | Epyc 7251 Firmware | before naplespi_1.0.0.h |
| Amd | Epyc 7261 Firmware | before naplespi_1.0.0.h |
| Amd | Epyc 7281 Firmware | before naplespi_1.0.0.h |
| Amd | Epyc 7301 Firmware | before naplespi_1.0.0.h |
| Amd | Epyc 7351 Firmware | before naplespi_1.0.0.h |
| Amd | Epyc 7351p Firmware | before naplespi_1.0.0.h |
| Amd | Epyc 7371 Firmware | before naplespi_1.0.0.h |
| Amd | Epyc 7401 Firmware | before naplespi_1.0.0.h |
| Amd | Epyc 7401p Firmware | before naplespi_1.0.0.h |
| Amd | Epyc 7451 Firmware | before naplespi_1.0.0.h |
| Amd | Epyc 7501 Firmware | before naplespi_1.0.0.h |
Weakness classification
References
- NVD record
- CVE.org record
- https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-3002
- https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-4002
- https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-5001
- https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-3002
- https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-4002
- https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-5001