AMD Ryzen™ 3000 Series Desktop Processors “Matisse” AM4

CVE-2023-20555

HIGH 7.8

At a glance

Source: NVD
EPSS: EPSS 0.32 % · percentile 26 (2026-10-31)
State: PUBLISHED
Published: 2023-08-08 17:07 UTC
Updated: 2024-10-24 14:36 UTC
Assigner: AMD
NVD status: Modified

Search on…

Description

Insufficient input validation in CpmDisplayFeatureSmm may allow an attacker to corrupt SMM memory by overwriting an arbitrary bit in an attacker-controlled pointer potentially leading to arbitrary code execution in SMM.

Weaknesses (CWE)

CWE-787 — Out-of-bounds Write

References

https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-4003

Scores

Version	Score	Vector	Scored by
CVSS 3.1	HIGH 7.8	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	NVD · nvd@nist.gov (Primary)

European references

ENISA EUVD · EUVD-2023-24734
GCVE · GCVE-0-2023-20555

Affected configurations (NVD CPE)

cpe:2.3:o:amd:ryzen_3_3300_firmware:*:*:*:*:*:*:*:* < comboam4_pi_v1_1.0.0.a
cpe:2.3:o:amd:ryzen_3_3300x_firmware:*:*:*:*:*:*:*:* < comboam4_pi_v1_1.0.0.a
cpe:2.3:o:amd:ryzen_5_3600_firmware:*:*:*:*:*:*:*:* < comboam4_pi_v1_1.0.0.a
cpe:2.3:o:amd:ryzen_5_3600x_firmware:*:*:*:*:*:*:*:* < comboam4_pi_v1_1.0.0.a
cpe:2.3:o:amd:ryzen_7_3700_firmware:*:*:*:*:*:*:*:* < comboam4_pi_v1_1.0.0.a
cpe:2.3:o:amd:ryzen_7_3700x_firmware:*:*:*:*:*:*:*:* < comboam4_pi_v1_1.0.0.a
cpe:2.3:o:amd:ryzen_9_3800x_firmware:*:*:*:*:*:*:*:* < comboam4_pi_v1_1.0.0.a
cpe:2.3:o:amd:ryzen_9_3850x_firmware:*:*:*:*:*:*:*:* < comboam4_pi_v1_1.0.0.a
cpe:2.3:o:amd:ryzen_3_3300_firmware:*:*:*:*:*:*:*:* < comboam4v2_pi_1.2.0.a
cpe:2.3:o:amd:ryzen_3_3300x_firmware:*:*:*:*:*:*:*:* < comboam4v2_pi_1.2.0.a
cpe:2.3:o:amd:ryzen_5_3600_firmware:*:*:*:*:*:*:*:* < comboam4v2_pi_1.2.0.a
cpe:2.3:o:amd:ryzen_5_3600x_firmware:*:*:*:*:*:*:*:* < comboam4v2_pi_1.2.0.a
cpe:2.3:o:amd:ryzen_7_3700_firmware:*:*:*:*:*:*:*:* < comboam4v2_pi_1.2.0.a
cpe:2.3:o:amd:ryzen_7_3700x_firmware:*:*:*:*:*:*:*:* < comboam4v2_pi_1.2.0.a
cpe:2.3:o:amd:ryzen_9_3800x_firmware:*:*:*:*:*:*:*:* < comboam4v2_pi_1.2.0.a
cpe:2.3:o:amd:ryzen_9_3850x_firmware:*:*:*:*:*:*:*:* < comboam4v2_pi_1.2.0.a
cpe:2.3:o:amd:ryzen_9_5950x_firmware:*:*:*:*:*:*:*:* < comboam4_v2_pi_1.2.0.a
cpe:2.3:o:amd:ryzen_9_5900x_firmware:*:*:*:*:*:*:*:* < comboam4_v2_pi_1.2.0.a
cpe:2.3:o:amd:ryzen_9_5900_firmware:*:*:*:*:*:*:*:* < comboam4_v2_pi_1.2.0.a
cpe:2.3:o:amd:ryzen_9_pro_5945_firmware:*:*:*:*:*:*:*:* < comboam4_v2_pi_1.2.0.a
cpe:2.3:o:amd:ryzen_7_5800x3d_firmware:*:*:*:*:*:*:*:* < comboam4_v2_pi_1.2.0.a
cpe:2.3:o:amd:ryzen_7_5800x_firmware:*:*:*:*:*:*:*:* < comboam4_v2_pi_1.2.0.a
cpe:2.3:o:amd:ryzen_7_5800_firmware:*:*:*:*:*:*:*:* < comboam4_v2_pi_1.2.0.a
cpe:2.3:o:amd:ryzen_7_5700x_firmware:*:*:*:*:*:*:*:* < comboam4_v2_pi_1.2.0.a
cpe:2.3:o:amd:ryzen_7_pro_5845_firmware:*:*:*:*:*:*:*:* < comboam4_v2_pi_1.2.0.a
cpe:2.3:o:amd:ryzen_5_5600x3d_firmware:*:*:*:*:*:*:*:* < comboam4_v2_pi_1.2.0.a
cpe:2.3:o:amd:ryzen_5_5600x_firmware:*:*:*:*:*:*:*:* < comboam4_v2_pi_1.2.0.a
cpe:2.3:o:amd:ryzen_5_5600_firmware:*:*:*:*:*:*:*:* < comboam4_v2_pi_1.2.0.a
cpe:2.3:o:amd:ryzen_5_pro_5645_firmware:*:*:*:*:*:*:*:* < comboam4_v2_pi_1.2.0.a
cpe:2.3:o:amd:ryzen_7_5700_firmware:*:*:*:*:*:*:*:* < comboam4v2_pi_1.2.0.a
cpe:2.3:o:amd:ryzen_5_5500_firmware:*:*:*:*:*:*:*:* < comboam4v2_pi_1.2.0.a
cpe:2.3:o:amd:ryzen_3_5100_firmware:*:*:*:*:*:*:*:* < comboam4v2_pi_1.2.0.a
cpe:2.3:o:amd:ryzen_7_5700g_firmware:*:*:*:*:*:*:*:* < comboam4v2_pi_1.2.0.a
cpe:2.3:o:amd:ryzen_7_5700ge_firmware:*:*:*:*:*:*:*:* < comboam4v2_pi_1.2.0.a
cpe:2.3:o:amd:ryzen_5_5600g_firmware:*:*:*:*:*:*:*:* < comboam4v2_pi_1.2.0.a
cpe:2.3:o:amd:ryzen_5_5600ge_firmware:*:*:*:*:*:*:*:* < comboam4v2_pi_1.2.0.a
cpe:2.3:o:amd:ryzen_3_5300g_firmware:*:*:*:*:*:*:*:* < comboam4v2_pi_1.2.0.a
cpe:2.3:o:amd:ryzen_3_5300ge_firmware:*:*:*:*:*:*:*:* < comboam4v2_pi_1.2.0.a
cpe:2.3:o:amd:ryzen_9_7950x3d_firmware:*:*:*:*:*:*:*:* < comboam5_1.0.0.6
cpe:2.3:o:amd:ryzen_9_7950x_firmware:*:*:*:*:*:*:*:* < comboam5_1.0.0.6
+92 more

Affected products

Product	Versions
AMD · Ryzen™ 3000 Series Desktop Processors “Matisse” AM4	affected various
AMD · Ryzen™ 5000 Series Desktop Processors “Vermeer” AM4	affected various
AMD · Ryzen™ 5000 Series Desktop Processor with Radeon™ Graphics “Cezanne” AM4	affected various
AMD · Ryzen™ 7000 Series Processors “Raphael”	affected various
AMD · Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics “Picasso”	affected various
AMD · Ryzen™ 4000 Series Desktop Processors with Radeon™ Graphics “Renoir” FP5	affected various
AMD · Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics “Dali”/”Dali” FP5	affected various
AMD · Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics “Pollock”	affected various
AMD · Ryzen™ 3000 Series Mobile Processors with Radeon™ Graphics “Picasso”	affected various
AMD · Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics “Renoir” FP6	affected various
AMD · Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics “Lucienne”	affected various
AMD · Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics “Cezanne”	affected various
AMD · Ryzen™ 6000 Series Mobile Processors "Rembrandt"	affected various
AMD · Ryzen™ 7030 Series Mobile Processors “Barcelo”	affected various
AMD · Ryzen™ 7020 Series Mobile Processors “Mendocino”	affected various

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD

⚠️ AMD Ryzen™ 3000 Series Desktop Processors “Matisse” AM4