CVE-2023-31346: amd 3rd gen amd epyc™ processors Improper Access Control

CVSS: 6.0v3.1MediumModified

AliasesRHSA-2024:4262RHSA-2024:4409RHSA-2024:4733+4 more

Published 13-02-2024Last modified 20-03-2025

Vulnerability summary

CVE-2023-31346 is a medium (CVSS 6.0) Improper Access Control vulnerability in amd 3rd gen amd epyc™ processors. EPSS estimates a 0.31% chance of exploitation in the next 30 days, higher than 22.3% of scored vulnerabilities.

Overall risk

24/100

0100

Low · default modelHow is this calculated?

CVSS score

6.0/10

010

Medium · v3.1 (CVE.org)

EPSS score

0.31%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1

RHSA-2024:5883

Timeline

13-02-2024
PublishedVulnerability first disclosed.
20-03-2025
Last modifiedVulnerability information updated.

Description

Failure to initialize memory in SEV Firmware may allow a privileged attacker to access stale data from other guests.

CVSS metrics

4 scores · 4 sources · 1 version

v3.16.0

EPSS trend

Probability

0.31%

Chance of exploitation in the next 30 days

Percentile

22%

Versus all other CVEs

30-day change

0.00 pp

From 0.31% on 19-09-2026

19-09-202619-10-2026

EPSS score

0.31%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Affected systems

Amd64 products

Show all 64

Redhat23 products

iwl100-firmware< 0:39.31.5.1-122.el8_10.1 | < 0:39.31.5.1-114.1.el8_6.1 | < 0:39.31.5.1-106.1.el8_4.1 | < 0:39.31.5.1-118.1.el8_8.1 | < 0:39.31.5.1-143.1.el9_4 | < 0:39.31.5.1-138.1.el9_2
iwl1000-firmware< 1:39.31.5.1-122.el8_10.1 | < 1:39.31.5.1-114.1.el8_6.1 | < 1:39.31.5.1-106.1.el8_4.1 | < 1:39.31.5.1-118.1.el8_8.1 | < 1:39.31.5.1-143.1.el9_4 | < 1:39.31.5.1-138.1.el9_2
iwl105-firmware< 0:18.168.6.1-122.el8_10.1 | < 0:18.168.6.1-114.1.el8_6.1 | < 0:18.168.6.1-106.1.el8_4.1 | < 0:18.168.6.1-118.1.el8_8.1 | < 0:18.168.6.1-143.1.el9_4 | < 0:18.168.6.1-138.1.el9_2
iwl135-firmware< 0:18.168.6.1-122.el8_10.1 | < 0:18.168.6.1-114.1.el8_6.1 | < 0:18.168.6.1-106.1.el8_4.1 | < 0:18.168.6.1-118.1.el8_8.1 | < 0:18.168.6.1-143.1.el9_4 | < 0:18.168.6.1-138.1.el9_2
iwl2000-firmware< 0:18.168.6.1-122.el8_10.1 | < 0:18.168.6.1-114.1.el8_6.1 | < 0:18.168.6.1-106.1.el8_4.1 | < 0:18.168.6.1-118.1.el8_8.1 | < 0:18.168.6.1-143.1.el9_4 | < 0:18.168.6.1-138.1.el9_2

iwl2030-firmware< 0:18.168.6.1-122.el8_10.1 | < 0:18.168.6.1-114.1.el8_6.1 | < 0:18.168.6.1-106.1.el8_4.1 | < 0:18.168.6.1-118.1.el8_8.1 | < 0:18.168.6.1-143.1.el9_4 | < 0:18.168.6.1-138.1.el9_2
iwl3160-firmware< 1:25.30.13.0-122.el8_10.1 | < 1:25.30.13.0-114.1.el8_6.1 | < 1:25.30.13.0-106.1.el8_4.1 | < 1:25.30.13.0-118.1.el8_8.1 | < 1:25.30.13.0-143.1.el9_4 | < 1:25.30.13.0-138.1.el9_2
iwl3945-firmware< 0:15.32.2.9-122.el8_10.1 | < 0:15.32.2.9-114.1.el8_6.1 | < 0:15.32.2.9-106.1.el8_4.1 | < 0:15.32.2.9-118.1.el8_8.1
iwl4965-firmware< 0:228.61.2.24-122.el8_10.1 | < 0:228.61.2.24-114.1.el8_6.1 | < 0:228.61.2.24-106.1.el8_4.1 | < 0:228.61.2.24-118.1.el8_8.1
iwl5000-firmware< 0:8.83.5.1_1-122.el8_10.1 | < 0:8.83.5.1_1-114.1.el8_6.1 | < 0:8.83.5.1_1-106.1.el8_4.1 | < 0:8.83.5.1_1-118.1.el8_8.1 | < 0:8.83.5.1_1-143.1.el9_4 | < 0:8.83.5.1_1-138.1.el9_2
iwl5150-firmware< 0:8.24.2.2-122.el8_10.1 | < 0:8.24.2.2-114.1.el8_6.1 | < 0:8.24.2.2-106.1.el8_4.1 | < 0:8.24.2.2-118.1.el8_8.1 | < 0:8.24.2.2-143.1.el9_4 | < 0:8.24.2.2-138.1.el9_2
iwl6000-firmware< 0:9.221.4.1-122.el8_10.1 | < 0:9.221.4.1-114.1.el8_6.1 | < 0:9.221.4.1-106.1.el8_4.1 | < 0:9.221.4.1-118.1.el8_8.1
iwl6000g2a-firmware< 0:18.168.6.1-122.el8_10.1 | < 0:18.168.6.1-114.1.el8_6.1 | < 0:18.168.6.1-106.1.el8_4.1 | < 0:18.168.6.1-118.1.el8_8.1 | < 0:18.168.6.1-143.1.el9_4 | < 0:18.168.6.1-138.1.el9_2
iwl6000g2b-firmware< 0:18.168.6.1-122.el8_10.1 | < 0:18.168.6.1-114.1.el8_6.1 | < 0:18.168.6.1-106.1.el8_4.1 | < 0:18.168.6.1-118.1.el8_8.1 | < 0:18.168.6.1-143.1.el9_4 | < 0:18.168.6.1-138.1.el9_2
iwl6050-firmware< 0:41.28.5.1-122.el8_10.1 | < 0:41.28.5.1-114.1.el8_6.1 | < 0:41.28.5.1-106.1.el8_4.1 | < 0:41.28.5.1-118.1.el8_8.1 | < 0:41.28.5.1-143.1.el9_4 | < 0:41.28.5.1-138.1.el9_2
iwl7260-firmware< 1:25.30.13.0-122.el8_10.1 | < 1:25.30.13.0-114.1.el8_6.1 | < 1:25.30.13.0-106.1.el8_4.1 | < 1:25.30.13.0-118.1.el8_8.1 | < 1:25.30.13.0-143.1.el9_4 | < 1:25.30.13.0-138.1.el9_2
libertas-sd8686-firmware< 0:20240610-122.git90df68d2.el8_10 | < 0:20240610-114.1.git90df68d2.el8_6 | < 0:20240610-106.1.git90df68d2.el8_4 | < 0:20240610-118.1.git90df68d2.el8_8
libertas-sd8787-firmware< 0:20240610-122.git90df68d2.el8_10 | < 0:20240610-114.1.git90df68d2.el8_6 | < 0:20240610-106.1.git90df68d2.el8_4 | < 0:20240610-118.1.git90df68d2.el8_8 | < 0:20240603-143.1.el9_4 | < 0:20240603-138.1.el9_2
libertas-usb8388-firmware< 2:20240610-122.git90df68d2.el8_10 | < 2:20240610-114.1.git90df68d2.el8_6 | < 2:20240610-106.1.git90df68d2.el8_4 | < 2:20240610-118.1.git90df68d2.el8_8
libertas-usb8388-olpc-firmware< 0:20240610-122.git90df68d2.el8_10 | < 0:20240610-114.1.git90df68d2.el8_6 | < 0:20240610-106.1.git90df68d2.el8_4 | < 0:20240610-118.1.git90df68d2.el8_8
linux-firmware< 0:20240610-122.git90df68d2.el8_10 | < 0:20240610-114.1.git90df68d2.el8_6 | < 0:20240610-106.1.git90df68d2.el8_4 | < 0:20240610-118.1.git90df68d2.el8_8 | < 0:20240603-143.1.el9_4 | < 0:20240603-138.1.el9_2
linux-firmware-whence< 0:20240603-143.1.el9_4 | < 0:20240603-138.1.el9_2
netronome-firmware< 0:20240603-143.1.el9_4 | < 0:20240603-138.1.el9_2

Show all 23

Ubuntu1 product

linux-firmwareAll versions (No fix recorded)

3 vendors · 88 products

References

20 links

www.amd.com/en/corporate/product-security/bulletin/AMD-SB-3007Vendor AdvisoryREPORT
access.redhat.com/errata/RHSA-2024:4262Advisory
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=2250458REPORT
security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_4262.jsonAdvisory
access.redhat.com/security/cve/CVE-2023-31346REPORT
www.cve.org/CVERecord?id=CVE-2023-31346AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2023-31346Advisory
www.amd.com/en/resources/product-security/bulletin/amd-sb-3007.htmlARTICLE
access.redhat.com/errata/RHSA-2024:4409Advisory

Show all 20 references

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities