Read the docs
TI-2023-15013 Aliases CVE-2023-31356GHSA-3w7r-v4fr-r43w

Incomplete system memory cleanup in SEV firmware could allow a privileged attacker to…

Priority LOW 20CWE-459Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

Incomplete system memory cleanup in SEV firmware could allow a privileged attacker to corrupt guest private memory, potentially resulting in a loss of data integrity.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00214 11th percentileScored 2026-11-07
Fix Fixed AMD EPYC™ 7003 Processors (AMD): MilanPI 1.0.0.CAMD EPYC™ 9004 Processors (AMD): GenoaPI 1.0.0.B+2 more productsRed Hat: 5 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AMDAMD EPYC™ 7003 Processors—MilanPI 1.0.0.CPatch availableCNA
AMDAMD EPYC™ 9004 Processors—GenoaPI 1.0.0.BPatch availableCNA
AMDAMD EPYC™ Embedded 7003—"EmbMilanPI-SP3 1.0.0.8"Patch availableCNA
AMDAMD EPYC™ Embedded 9004—EmbGenoaPI-SP5 1.0.0.6Patch availableCNA
  • AMD EPYC™ 7003 Processors VendorAMD Affected — Fixed in MilanPI 1.0.0.C Patch available CNA
  • AMD EPYC™ 9004 Processors VendorAMD Affected — Fixed in GenoaPI 1.0.0.B Patch available CNA
  • AMD EPYC™ Embedded 7003 VendorAMD Affected — Fixed in "EmbMilanPI-SP3 1.0.0.8" Patch available CNA
  • AMD EPYC™ Embedded 9004 VendorAMD Affected — Fixed in EmbGenoaPI-SP5 1.0.0.6 Patch available CNA

Remediation

  • Fix · CNA AMD EPYC™ 7003 Processors (AMD) Fixed in MilanPI 1.0.0.C
  • Fix · CNA AMD EPYC™ 9004 Processors (AMD) Fixed in GenoaPI 1.0.0.B
  • Fix · CNA AMD EPYC™ Embedded 7003 (AMD) Fixed in "EmbMilanPI-SP3 1.0.0.8"
  • Fix · CNA AMD EPYC™ Embedded 9004 (AMD) Fixed in EmbGenoaPI-SP5 1.0.0.6

Red Hat 5 advisories

  • RHSA-2024:7484 Released 2024-10-02 · Red Hat rating Moderate
    linux-firmware security update
    • Red Hat Enterprise Linux BaseOS (v. 9) iwl100-firmware-39.31.5.1-143.3.el9_4, iwl1000-firmware-1:39.31.5.1-143.3.el9_4, iwl105-firmware-18.168.6.1-143.3.el9_4 +14
  • RHSA-2024:7481 Released 2024-10-02 · Red Hat rating Important
    linux-firmware security update
    • Red Hat Enterprise Linux BaseOS (v. 8) iwl100-firmware-39.31.5.1-124.el8_10.1, iwl1000-firmware-1:39.31.5.1-124.el8_10.1, iwl105-firmware-18.168.6.1-124.el8_10.1 +18
  • RHSA-2024:7482 Released 2024-10-02 · Red Hat rating Moderate
    linux-firmware security update
    • Red Hat Enterprise Linux BaseOS EUS (v.8.8) iwl100-firmware-39.31.5.1-118.3.el8_8.1, iwl1000-firmware-1:39.31.5.1-118.3.el8_8.1, iwl105-firmware-18.168.6.1-118.3.el8_8.1 +18
Show 2 more Red Hat advisories
  • RHSA-2024:7483 Released 2024-10-02 · Red Hat rating Low
    linux-firmware security update
    • Red Hat Enterprise Linux BaseOS EUS (v.9.2) iwl100-firmware-39.31.5.1-138.3.el9_2, iwl1000-firmware-1:39.31.5.1-138.3.el9_2, iwl105-firmware-18.168.6.1-138.3.el9_2 +14
  • RHSA-2024:7418 Released 2024-10-01 · Red Hat rating Moderate
    linux-firmware security update
    • Red Hat Enterprise Linux BaseOS AUS (v.8.6) iwl100-firmware-39.31.5.1-114.3.el8_6.1, iwl1000-firmware-1:39.31.5.1-114.3.el8_6.1, iwl105-firmware-18.168.6.1-114.3.el8_6.1 +18
    • Red Hat Enterprise Linux BaseOS E4S (v.8.6) iwl100-firmware-39.31.5.1-114.3.el8_6.1, iwl1000-firmware-1:39.31.5.1-114.3.el8_6.1, iwl105-firmware-18.168.6.1-114.3.el8_6.1 +18
    • Red Hat Enterprise Linux BaseOS TUS (v.8.6) iwl100-firmware-39.31.5.1-114.3.el8_6.1, iwl1000-firmware-1:39.31.5.1-114.3.el8_6.1, iwl105-firmware-18.168.6.1-114.3.el8_6.1 +18

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    AMD EPYC™ 7003 Processors, AMD EPYC™ 9004 Processors, AMD EPYC™ Embedded 7003 — amd.com/en/resources/product-security/bulletin/amd-sb-3003.…

    4 records Highest priority Priority LOW 4 LOW

    Other records, highest priority first

    • TI-2023-07029 Time-of-check time-of-use race condition in AMD EPYC™ 7001 ProcessorsPriority LOW 34
    • TI-2023-07034 IOMMU improperly handles certain special address ranges with invalid device table entries…Priority LOW 26
    • TI-2021-21465 Buffer overflow in AMD EPYC™ 7001 ProcessorsPriority LOW 23
    Show all 4 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2024:7481
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2024:7484
Red Hat Enterprise Linux BaseOS AUS (v.8.6)Fixed RHSA-2024:7418
Red Hat Enterprise Linux BaseOS E4S (v.8.6)Fixed RHSA-2024:7418
Red Hat Enterprise Linux BaseOS EUS (v.8.8)Fixed RHSA-2024:7482
Red Hat Enterprise Linux BaseOS EUS (v.9.2)Fixed RHSA-2024:7483
Red Hat Enterprise Linux BaseOS TUS (v.8.6)Fixed RHSA-2024:7418
Not affected: 3 products
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-31356
  2. 2026-10-03 Alias added: GHSA-3w7r-v4fr-r43w

References

Advisory 1

Other 1

  • TI-2026-36341 AI Tensor Engine for ROCm (AITER) 0.1.14 Unauthenticated RCE via MessageQueue.recv() Pickle Deserialization CVSS 4.0CRITICAL 9.2
  • TI-2023-07046 Improper privilege management in AMD Radeon™ RX 5000 Series Graphics Cards CVSS 3.1HIGH 7.8
  • TI-2023-04574 GPU kernel implementations susceptible to memory leak CVSS 3.1MEDIUM 6.5
  • TI-2023-07042 Information disclosure through error messages in AMD Ryzen™ 3000 Series Desktop… CVSS 3.1MEDIUM 5.5
  • TI-2023-23747 PVRIC (PowerVR Image Compression) on Imagination 2018 and later GPU devices offers… CVSS 3.1MEDIUM 5.3
  • TI-2022-07839 Improper access control in System Management Mode (SMM) may allow an attacker to write to… CVSS 3.1CRITICAL 9.8
See all 508 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences