« Volver al listado

CVE-2023-31356

Estado: AplazadaMedia (4.4)—

Incomplete system memory cleanup in SEV firmware could allow a privileged attacker to corrupt guest private memory, potentially resulting in a loss of data integrity.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

AMD — SEV FirmwareAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-31356",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-31356",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-08-14T15:46:30.501050Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@amd.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.4,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 0.8
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@amd.com",
      "affectedData": [
        {
          "vendor": "AMD",
          "product": "AMD EPYC™ 7003 Processors",
          "versions": [
            {
              "status": "unaffected",
              "version": "MilanPI 1.0.0.C",
              "versionType": "PI"
            }
          ],
          "defaultStatus": "affected"
        },
        {
          "vendor": "AMD",
          "product": "AMD EPYC™ 9004 Processors",
          "versions": [
            {
              "status": "unaffected",
              "version": "GenoaPI 1.0.0.B"
            }
          ],
          "defaultStatus": "affected"
        },
        {
          "vendor": "AMD",
          "product": "AMD EPYC™ Embedded 7003",
          "versions": [
            {
              "status": "unaffected",
              "version": "\"EmbMilanPI-SP3  1.0.0.8\""
            }
          ],
          "defaultStatus": "affected"
        },
        {
          "vendor": "AMD",
          "product": "AMD EPYC™ Embedded 9004",
          "versions": [
            {
              "status": "unaffected",
              "version": "EmbGenoaPI-SP5 1.0.0.6"
            }
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2024-08-13T17:15:21.733",
  "references": [
    {
      "url": "https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3003.html",
      "source": "psirt@amd.com"
    },
    {
      "url": "https://www.amd.com/en/resources/product-security/bulletin/amd-sb-5004.html",
      "source": "psirt@amd.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@amd.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-459"
        }
      ]
    },
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-459"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Incomplete system memory cleanup in SEV firmware could\nallow a privileged attacker to corrupt guest private memory, potentially\nresulting in a loss of data integrity."
    },
    {
      "lang": "es",
      "value": "Una limpieza incompleta de la memoria del sistema en el firmware SEV podría permitir que un atacante privilegiado corrompa la memoria privada del huésped, lo que podría provocar una pérdida de integridad de los datos."
    }
  ],
  "lastModified": "2026-06-17T05:56:50.717",
  "sourceIdentifier": "psirt@amd.com"
}