« Volver al listado

CVE-2023-20599

Estado: AplazadaAlta (7.9)—

Improper register access control in ASP may allow a privileged attacker to perform unauthorized access to ASP’s Crypto Co-Processor (CCP) registers from x86 resulting in potential loss of control of cryptographic key pointer/index leading to loss of integrity or confidentiality.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Acceso local (AV:L) con privilegios altos (PR:H) sin interacción permite escalar y acceder a registros de CCP para robar claves criptográficas (T1552.007) o manipular su integridad (T1565.001).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

User Account ManagementThreat Intelligence ProgramRestrict File and Directory PermissionsPrivileged Account ManagementRemote Data StorageNetwork Segmentation

Tecnologías afectadas (2)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

AMD — ASPAIAMD — Crypto Co-processorAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-20599",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-20599",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-06-11T04:01:37.861337Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@amd.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 7.9,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.8,
        "exploitabilityScore": 1.5
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@amd.com",
      "affectedData": [
        {
          "vendor": "AMD",
          "product": "AMD EPYC™ 7002 Series Processors",
          "versions": [
            {
              "status": "unaffected",
              "version": "RomePI 100H SEV 0.24.19 [hex 00.18.13]"
            }
          ],
          "defaultStatus": "affected"
        },
        {
          "vendor": "AMD",
          "product": "AMD Ryzen™ Threadripper™ 3000 Processors",
          "versions": [
            {
              "status": "unaffected",
              "version": "CastlePeakPI-SP3r3_1.0.0.F"
            }
          ],
          "defaultStatus": "affected"
        },
        {
          "vendor": "AMD",
          "product": "AMD Ryzen™ Threadripper™ PRO 3000 WX Processors",
          "versions": [
            {
              "status": "unaffected",
              "version": "ChagallWSPI-sWRX8 1.0.0.C"
            },
            {
              "status": "unaffected",
              "version": "CastlePeakWSPI-sWRX8 1.0.0.H"
            }
          ],
          "defaultStatus": "affected"
        },
        {
          "vendor": "AMD",
          "product": "AMD Ryzen™ 3000 Series Mobile Processors with Radeon™ Graphics",
          "versions": [
            {
              "status": "unaffected",
              "version": "PicassoPI-FP5_1.0.1.2c"
            }
          ],
          "defaultStatus": "affected"
        },
        {
          "vendor": "AMD",
          "product": "AMD EPYC™ Embedded 7002 Series Processors",
          "versions": [
            {
              "status": "unaffected",
              "version": "EmbRomePI-SP3 1.0.0.B"
            }
          ],
          "defaultStatus": "affected"
        },
        {
          "vendor": "AMD",
          "product": "AMD EPYC™ Embedded 7003 Series Processors",
          "versions": [
            {
              "status": "unaffected",
              "version": "EmbMilanPI-SP3 1.0.0.8"
            }
          ],
          "defaultStatus": "affected"
        },
        {
          "vendor": "AMD",
          "product": "AMD Ryzen™ Embedded R1000 Series Processors",
          "versions": [
            {
              "status": "unaffected",
              "version": "EmbeddedPI-FP5 1211"
            }
          ],
          "defaultStatus": "affected"
        },
        {
          "vendor": "AMD",
          "product": "AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics",
          "versions": [
            {
              "status": "unaffected",
              "version": "EmbeddedPI-FP5 1211"
            }
          ],
          "defaultStatus": "affected"
        },
        {
          "vendor": "AMD",
          "product": "AMD Ryzen™ Embedded R2000 Series Processors",
          "versions": [
            {
              "status": "unaffected",
              "version": "EmbeddedR2KPI-FP5 1006"
            }
          ],
          "defaultStatus": "affected"
        },
        {
          "vendor": "AMD",
          "product": "AMD Ryzen™ Embedded V1000 Series Processors",
          "versions": [
            {
              "status": "unaffected",
              "version": "EmbeddedPI-FP5 1211 RC1"
            }
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2025-06-10T17:17:51.013",
  "references": [
    {
      "url": "https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-7039.html",
      "source": "psirt@amd.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@amd.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1262"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper register access control in ASP may allow a privileged attacker to perform unauthorized access to ASP’s Crypto Co-Processor (CCP) registers from x86 resulting in potential loss of control of cryptographic key pointer/index leading to loss of integrity or confidentiality."
    },
    {
      "lang": "es",
      "value": "Un control de acceso inadecuado a los registros en ASP puede permitir que un atacante privilegiado realice un acceso no autorizado a los registros del coprocesador criptográfico (CCP) de ASP desde x86, lo que genera una posible pérdida de control del índice/puntero de la clave criptográfica y, por consiguiente, una pérdida de integridad o confidencialidad."
    }
  ],
  "lastModified": "2026-06-17T05:30:24.457",
  "sourceIdentifier": "psirt@amd.com"
}