AMD MSB-7029 Firmware VULNs: SPI ROM & SMU CVEs with Patch Versions

Key Information Summary for AMD Processor Vulnerabilities (MSB-7029) Vulnerability Overview Advisory ID: MSB-7029 Severity Level: High Vulnerability List: - CVE-2023-20576: Insufficient data authenticity verification in AGESA allows an attacker to update SPI ROM data, potentially leading to service disruption or privilege escalation. - CVE-2023-20577: Heap overflow in the SMU module allows an attacker with SMU access to trigger arbitrary code execution. - CVE-2023-20579: A deficiency in kernel (Ring0) process management within the AMD SPI Protection feature may result in a loss of integrity and availability. - CVE-2023-20587: Improved access control in system management mode allows an attacker to access SPI Flash, potentially leading to arbitrary code execution. Scope of Impact Data Center: 1st Gen AMD EPYC, 2nd Gen AMD EPYC, 3rd Gen AMD EPYC, and 4th Gen AMD EPYC are affected. Data Center GPUs: AMD Instinct MI300A is affected (MI300A is the only model affected in the Data Center GPU product line). Desktop: AMD Ryzen 3000/5000/7000 series desktop processors and AMD Ryzen 3000 series desktop processors (with integrated Radeon graphics) are affected. High-End Desktop (HEDT): AMD Ryzen Threadripper 3000 series processors are affected. Workstations: AMD Ryzen Threadripper PRO 3000X series and AMD Ryzen Threadripper PRO 5000X series processors are affected. Mobile: AMD Athlon 3000 series mobile processors (with integrated Radeon graphics) and AMD Ryzen 3000 series mobile processors (with integrated Radeon graphics) are affected. Embedded: AMD EPYC Embedded 300/702/703/903, AMD Ryzen Embedded R1000/R2000/R5000, and AMD Ryzen Embedded V1000/V2000 are affected. Remediation General Recommendation: Keep operating systems, firmware, and software updated to the latest versions; ensure the latest firmware and software are installed. Minimum Fixed Versions per Product Line (partial examples): - Data Center: - 1st Gen EPYC: NapaSPI 1.0.0 (2023-04-27) - 2nd Gen EPYC: RomePI 1.0.0 (2023-11-07) - 3rd Gen EPYC: MilanPI 1.0.0 (2023-12-18) - 4th Gen EPYC: GenoaPI 1.0.0 (2023-09-09) - Desktop: - Ryzen 3000 Series: ComboAM4v1.2.0 (2023-08-25) - Ryzen 5000 Series: ComboAM4v2.1.2.0 (2023-08-25) - Ryzen 7000 Series: ComboAM5 1.0.8.0 (2023-07-21) - Mobile: - Athlon 3000 Mobile: PicoSPI-FPS 1.0.1.0 (2023-05-31) - Ryzen 3000 Mobile: PolacoPI-FTS 1.0.0.6 (2023-10-26) - Embedded: - EPYC Embedded 300: SnowySPI 1.1.0.0 (2023-12-15) - EPYC Embedded 702: EmbRomePI-SP3 1.0.0.8 (2023-12-15) - EPYC Embedded 703: EmbMilanPI-SP3 1.0.0.8 (2024-01-15) - EPYC Embedded 903: EmbGenoaPI-SP3 1.0.0.3 (2023-09-15) > Note: The advisory does not include proof-of-concept (POC) code or exploit code.

Goal Reached Thanks to every supporter — we hit 100%!

AMD MSB-7029 Firmware VULNs: SPI ROM & SMU CVEs with Patch Versions