CVE-2023-31304 - OpenCVE

Improper input validation in SMU may allow an attacker with privileges and a compromised physical function (PF) to modify the PCIe® lane count and speed, potentially leading to a loss of availability.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://www.amd.com/en/resources/product-security/bulletin/amd-sb-6005.html

History

Mon, 04 Nov 2024 17:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-1284

Wed, 14 Aug 2024 15:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 13 Aug 2024 17:00:00 +0000

Type	Values Removed	Values Added
Description		Improper input validation in SMU may allow an attacker with privileges and a compromised physical function (PF) to modify the PCIe® lane count and speed, potentially leading to a loss of availability.
References		https://www.amd.com/en/resources/product-security/bulletin/amd-sb-6005.html
Metrics		cvssV3_1 `{'score': 2.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L'}`

MITRE

Status: PUBLISHED

Assigner: AMD

Published: 2024-08-13T16:53:44.552Z

Updated: 2024-11-04T16:38:19.642Z

Reserved: 2023-04-27T15:25:41.422Z

Link: CVE-2023-31304

Vulnrichment

Updated: 2024-08-14T14:27:04.151Z

NVD

Status : Awaiting Analysis

Published: 2024-08-13T17:15:20.110

Modified: 2024-11-04T17:35:02.577

Link: CVE-2023-31304

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-31304", "assignerOrgId": "b58fc414-a1e4-4f92-9d70-1add41838648", "state": "PUBLISHED", "assignerShortName": "AMD", "dateReserved": "2023-04-27T15:25:41.422Z", "datePublished": "2024-08-13T16:53:44.552Z", "dateUpdated": "2024-11-04T16:38:19.642Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "product": "AMD Radeon\u2122 RX 6000 Series Graphics Cards", "vendor": "AMD", "versions": [{"status": "unaffected", "version": "AMD Software: Adrenalin Edition 23.12.1 (23.30.13.01)"}]}, {"defaultStatus": "affected", "product": "AMD Radeon\u2122 PRO W6000 Series Graphics Cards", "vendor": "AMD", "versions": [{"status": "unaffected", "version": "AMD Software: PRO Edition 23.Q4 (23.30.13.03)"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Improper input validation in SMU may allow an attacker with privileges and a compromised physical function (PF)     to modify the PCIe\u00ae lane count and speed, potentially leading to a loss of availability.    "}], "value": "Improper input validation in SMU may allow an attacker with privileges and a compromised physical function (PF) \u00a0 \u00a0 to modify the PCIe\u00ae lane count and speed, potentially leading to a loss of availability."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 2.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "providerMetadata": {"orgId": "b58fc414-a1e4-4f92-9d70-1add41838648", "shortName": "AMD", "dateUpdated": "2024-08-13T16:53:44.552Z"}, "references": [{"url": "https://www.amd.com/en/resources/product-security/bulletin/amd-sb-6005.html"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-1284", "lang": "en", "description": "CWE-1284 Improper Validation of Specified Quantity in Input"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-08-14T14:26:55.018429Z", "id": "CVE-2023-31304", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-04T16:38:19.642Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-31304", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-08-14T14:26:55.018429Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1284", "description": "CWE-1284 Improper Validation of Specified Quantity in Input"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-14T14:27:04.151Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "AMD", "product": "AMD Radeon\u2122 RX 6000 Series Graphics Cards", "versions": [{"status": "unaffected", "version": "AMD Software: Adrenalin Edition 23.12.1 (23.30.13.01)"}], "defaultStatus": "affected"}, {"vendor": "AMD", "product": "AMD Radeon\u2122 PRO W6000 Series Graphics Cards", "versions": [{"status": "unaffected", "version": "AMD Software: PRO Edition 23.Q4 (23.30.13.03)"}], "defaultStatus": "affected"}], "references": [{"url": "https://www.amd.com/en/resources/product-security/bulletin/amd-sb-6005.html"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Improper input validation in SMU may allow an attacker with privileges and a compromised physical function (PF) \u00a0 \u00a0 to modify the PCIe\u00ae lane count and speed, potentially leading to a loss of availability.", "supportingMedia": [{"type": "text/html", "value": "Improper input validation in SMU may allow an attacker with privileges and a compromised physical function (PF)     to modify the PCIe\u00ae lane count and speed, potentially leading to a loss of availability.    ", "base64": false}]}], "providerMetadata": {"orgId": "b58fc414-a1e4-4f92-9d70-1add41838648", "shortName": "AMD", "dateUpdated": "2024-08-13T16:53:44.552Z"}}}, "cveMetadata": {"cveId": "CVE-2023-31304", "state": "PUBLISHED", "dateUpdated": "2024-11-04T16:38:19.642Z", "dateReserved": "2023-04-27T15:25:41.422Z", "assignerOrgId": "b58fc414-a1e4-4f92-9d70-1add41838648", "datePublished": "2024-08-13T16:53:44.552Z", "assignerShortName": "AMD"}, "dataVersion": "5.1"}