CVE-2023-31356

Published: Aug 13, 2024Modified: Jun 17, 2026Deferred

4.4

Vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Exploitability: 0.8 / Impact: 3.6

Source: psirt@amd.com (Secondary)

Description

Incomplete system memory cleanup in SEV firmware could allow a privileged attacker to corrupt guest private memory, potentially resulting in a loss of data integrity.

Related CWEs

CWE-459

Incomplete Cleanup

The product does not properly "clean up" and remove temporary or supporting resources after they have been used.

References (2)

https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3003.html

Source: psirt@amd.com

https://www.amd.com/en/resources/product-security/bulletin/amd-sb-5004.html

Source: psirt@amd.com

Timeline

No history available yet.