AMD Ryzen 9 Pro 3900 Firmware vulnerabilities

4 CVEs affecting AMD Ryzen 9 Pro 3900 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-20593, published 2023-07-24.

More from AMD.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2023-20593, published 2023-07-24. Medium severity, CVSS 5.5. EPSS: 5.2% chance of exploitation in the next 30 days. An issue in “Zen 2” CPUs, under specific microarchitectural circumstances, may allow an attacker to potentially access sensitive information.
• CVE-2023-20559, published 2023-04-02. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. Insufficient control flow management in AmdCpmGpioInitSmm may allow a privileged attacker to tamper with the SMM handler potentially leading to escalation of privileges.
• CVE-2023-20558, published 2023-04-02. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. Insufficient control flow management in AmdCpmOemSmm may allow a privileged attacker to tamper with the SMM handler potentially leading to an escalation of privileges.
• CVE-2022-27672, published 2023-03-01. Medium severity, CVSS 4.7. EPSS: 0.3% chance of exploitation in the next 30 days. When SMT is enabled, certain AMD processors may speculatively execute instructions using a target from the sibling thread after an SMT mode switch potentially resulting in information disclosure.