CVE-2023-31355 is a medium-severity vulnerability affecting AMD products, specifically related to improper restriction of write operations in SNP firmware. A malicious hypervisor could exploit this to overwrite a guest's UMC seed, potentially leading to unauthorized memory reading from a decommissioned guest. The attack requires high privileges and local access, but has a high confidentiality impact. Currently, there is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< milanpi_1.0.0.dCPE matchmatch criteria | cpe:2.3:o:amd:epyc_7203_firmware:*:*:*:*:*:*:*:* | ||
< milanpi_1.0.0.dCPE matchmatch criteria | cpe:2.3:o:amd:epyc_7203p_firmware:*:*:*:*:*:*:*:* | ||
< milanpi_1.0.0.dCPE matchmatch criteria | cpe:2.3:o:amd:epyc_72f3_firmware:*:*:*:*:*:*:*:* | ||
< milanpi_1.0.0.dCPE matchmatch criteria | cpe:2.3:o:amd:epyc_7303_firmware:*:*:*:*:*:*:*:* | ||
< milanpi_1.0.0.dCPE matchmatch criteria | cpe:2.3:o:amd:epyc_7303p_firmware:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.