Skip to content
Fencer Vulns
high 7.7

CVE-2023-20576 json

Insufficient Verification of Data Authenticity in AGESA™ may allow an attacker to update SPI ROM data potentially resulting in denial of se…

published 2026-09-02 2 mo ago modified 2026-09-04 2 mo ago also EUVD-2023-60616

cvss
7.7
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.1%
EPSS 0.1% chance of exploitation in 30 days, percentile 1%
public exploits
0
none known

Summary

Insufficient Verification of Data Authenticity in AGESA™ may allow an attacker to update SPI ROM data potentially resulting in denial of service or privilege escalation.

Patch / fix

  • AMD AMD Ryzen™ 3000 Series Desktop Processors ComboAM4v2 1.2.0.B
  • AMD AMD Ryzen™ 5000 Series Desktop Processors ComboAM4v2v 1.2.0.B
  • AMD AMD Ryzen™ 5000 Series Desktop Processors with Radeon™ Graphics ComboAM4v2 1.2.0.B
  • AMD AMD Ryzen™ 7000 Series Processors ComboAM5 1.0.0.7b
  • AMD AMD Ryzen™ 4000 Series Desktop Processors with Radeon™ Graphics ComboAM4v2 1.2.0.B
  • AMD AMD Ryzen™ Threadripper™ PRO 5000WX Processors ChagallWSPI-sWRX8 1.0.0.7
  • AMD AMD Ryzen™ 7020 Series Processors with Radeon™ Graphics MendocinoPI-FT6 1.0.0.6
  • AMD AMD Ryzen™ 6000 Series Processors with Radeon™ Graphics RembrandtPI-FP7 1.0.0.9b
  • AMD AMD Ryzen™ 7035 Series Processors with Radeon™ Graphics RembrandtPI-FP7 1.0.0.9b
  • AMD AMD Ryzen™ 7040 Series Processors with Radeon™ Graphics PhoenixPI-FP8-FP7 1.0.0.2
  • AMD AMD Ryzen™ 7045 Series Mobile Processors DragonRangeFL1PI 1.0.0.3a
  • AMD AMD Ryzen™ Embedded 5000 EmbAM4PI 1.0.0.4
  • AMD AMD Ryzen™ Embedded V3000 EmbeddedPI-FP7r2 1.0.0.8

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-20576 updated cvss 7.7

hw: amd: Insufficient Verification of Data Authenticity in AGESATM

  • Red Hat Enterprise Linux 7 linux-firmware, iwl100-firmware, iwl105-firmware, iwl135-firmware, iwl1000-firmware, iwl2000-firmware, +12 more Red Hat Enterprise Linux 8 linux-firmware, iwl100-firmware, iwl105-firmware, iwl135-firmware, iwl1000-firmware, iwl2000-firmware, +15 more Red Hat Enterprise Linux 9 linux-firmware, iwl100-firmware, iwl105-firmware, iwl135-firmware, iwl1000-firmware, iwl2000-firmware, +11 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
2 mo ago

Exploit prediction

0.12% chance of exploitation in the next 30 days, higher than 1% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.7 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Affected products

  • AMD AMD Ryzen™ 3000 Series Desktop Processors
  • AMD AMD Ryzen™ 5000 Series Desktop Processors
  • AMD AMD Ryzen™ 5000 Series Desktop Processors with Radeon™ Graphics
  • AMD AMD Ryzen™ 7000 Series Processors
  • AMD AMD Ryzen™ 4000 Series Desktop Processors with Radeon™ Graphics
  • AMD AMD Ryzen™ Threadripper™ PRO 5000WX Processors
  • AMD AMD Ryzen™ 7020 Series Processors with Radeon™ Graphics
  • AMD AMD Ryzen™ 6000 Series Processors with Radeon™ Graphics
  • AMD AMD Ryzen™ 7035 Series Processors with Radeon™ Graphics
  • AMD AMD Ryzen™ 7040 Series Processors with Radeon™ Graphics
  • AMD AMD Ryzen™ 7045 Series Mobile Processors
  • AMD AMD Ryzen™ Embedded 5000
  • AMD AMD Ryzen™ Embedded V3000

Classification

Weakness
  • CWE-345 Insufficient Verification of Data Authenticity

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.