CVE-2023-20555

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-08-08 · updated 2026-06-17
Weakness: CWE-787

Description

Insufficient input validation in CpmDisplayFeatureSmm may allow an attacker to corrupt SMM memory by overwriting an arbitrary bit in an attacker-controlled pointer potentially leading to arbitrary code execution in SMM.

Affected products

AMD Athlon 3015Ce Firmware: before pollockpi-ft5_1.0.0.5 — fixed in pollockpi-ft5_1.0.0.5
AMD Athlon 3015E Firmware: before pollockpi-ft5_1.0.0.5 — fixed in pollockpi-ft5_1.0.0.5
AMD Athlon Gold 3150C Firmware: before picassopi-fp5_1.0.0.f — fixed in picassopi-fp5_1.0.0.f
AMD Athlon Gold 3150G Firmware: before comboam4piv1_1.0.0.a; before comboam4v2_1.2.0.a — fixed in comboam4piv1_1.0.0.a, comboam4v2_1.2.0.a
AMD Athlon Gold 3150Ge Firmware: before comboam4piv1_1.0.0.a; before comboam4v2_1.2.0.a — fixed in comboam4piv1_1.0.0.a, comboam4v2_1.2.0.a
AMD Athlon Gold 3150U Firmware: before picassopi-fp5_1.0.0.f — fixed in picassopi-fp5_1.0.0.f
AMD Athlon Gold Pro 3150G Firmware: before comboam4piv1_1.0.0.a; before comboam4v2_1.2.0.a — fixed in comboam4piv1_1.0.0.a, comboam4v2_1.2.0.a
AMD Athlon Gold Pro 3150Ge Firmware: before comboam4piv1_1.0.0.a; before comboam4v2_1.2.0.a — fixed in comboam4piv1_1.0.0.a, comboam4v2_1.2.0.a
AMD Athlon Pro 300Ge Firmware: before comboam4piv1_1.0.0.a; before comboam4v2_1.2.0.a — fixed in comboam4piv1_1.0.0.a, comboam4v2_1.2.0.a
AMD Athlon Pro 3045B Firmware: before picassopi-fp5_1.0.0.f — fixed in picassopi-fp5_1.0.0.f
AMD Athlon Pro 3145B Firmware: before picassopi-fp5_1.0.0.f — fixed in picassopi-fp5_1.0.0.f
AMD Athlon Silver 3050C Firmware: before picassopi-fp5_1.0.0.f — fixed in picassopi-fp5_1.0.0.f
AMD Athlon Silver 3050E Firmware: before picassopi-fp5_1.0.0.f — fixed in picassopi-fp5_1.0.0.f
AMD Athlon Silver 3050U Firmware: before picassopi-fp5_1.0.0.f — fixed in picassopi-fp5_1.0.0.f
AMD Ryzen 3 3300 Firmware: before comboam4_pi_v1_1.0.0.a; before comboam4v2_pi_1.2.0.a — fixed in comboam4_pi_v1_1.0.0.a, comboam4v2_pi_1.2.0.a
AMD Ryzen 3 3300U Firmware: before picassopi-fp5_1.0.0.f — fixed in picassopi-fp5_1.0.0.f
AMD Ryzen 3 3300X Firmware: before comboam4_pi_v1_1.0.0.a; before comboam4v2_pi_1.2.0.a — fixed in comboam4_pi_v1_1.0.0.a, comboam4v2_pi_1.2.0.a
AMD Ryzen 3 3350U Firmware: before picassopi-fp5_1.0.0.f — fixed in picassopi-fp5_1.0.0.f
AMD Ryzen 3 4100 Firmware: before comboam4v2_pi_1.2.0.a — fixed in comboam4v2_pi_1.2.0.a
AMD Ryzen 3 4300U Firmware: before renoirpi-fp6_1.0.0.b — fixed in renoirpi-fp6_1.0.0.b
AMD Ryzen 3 5100 Firmware: before comboam4v2_pi_1.2.0.a — fixed in comboam4v2_pi_1.2.0.a
AMD Ryzen 3 5125C Firmware: before cezannepi-fp6_1.0.0.e — fixed in cezannepi-fp6_1.0.0.e
AMD Ryzen 3 5300G Firmware: before comboam4v2_pi_1.2.0.a — fixed in comboam4v2_pi_1.2.0.a
AMD Ryzen 3 5300Ge Firmware: before comboam4v2_pi_1.2.0.a — fixed in comboam4v2_pi_1.2.0.a
AMD Ryzen 3 5300U Firmware: before cezannepi-fp6_1.0.0.e — fixed in cezannepi-fp6_1.0.0.e
AMD Ryzen 3 5400U Firmware: before cezannepi-fp6_1.0.0.e — fixed in cezannepi-fp6_1.0.0.e
AMD Ryzen 3 5425U Firmware: before cezannepi-fp6_1.0.0.e — fixed in cezannepi-fp6_1.0.0.e
AMD Ryzen 3 7320U Firmware: before mendocinopi-ft6_1.0.0.5 — fixed in mendocinopi-ft6_1.0.0.5
AMD Ryzen 3 Pro 7330U Firmware: before cezannepi-fp6_1.0.0.e — fixed in cezannepi-fp6_1.0.0.e
AMD Ryzen 4700S Firmware: before comboam4v2_pi_1.2.0.a — fixed in comboam4v2_pi_1.2.0.a

How to fix

Upgrade to a fixed version: AMD Athlon 3015Ce Firmware pollockpi-ft5_1.0.0.5; AMD Athlon 3015E Firmware pollockpi-ft5_1.0.0.5; AMD Athlon Gold 3150C Firmware picassopi-fp5_1.0.0.f; AMD Athlon Gold 3150G Firmware comboam4piv1_1.0.0.a, comboam4v2_1.2.0.a; AMD Athlon Gold 3150Ge Firmware comboam4piv1_1.0.0.a, comboam4v2_1.2.0.a; AMD Athlon Gold 3150U Firmware picassopi-fp5_1.0.0.f; AMD Athlon Gold Pro 3150G Firmware comboam4piv1_1.0.0.a, comboam4v2_1.2.0.a; AMD Athlon Gold Pro 3150Ge Firmware comboam4piv1_1.0.0.a, comboam4v2_1.2.0.a; AMD Athlon Pro 300Ge Firmware comboam4piv1_1.0.0.a, comboam4v2_1.2.0.a; AMD Athlon Pro 3045B Firmware picassopi-fp5_1.0.0.f; AMD Athlon Pro 3145B Firmware picassopi-fp5_1.0.0.f; AMD Athlon Silver 3050C Firmware picassopi-fp5_1.0.0.f. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-20555 or the next vulnerability affects your stack