Skip to content
Fencer Vulns
high 7.5

CVE-2023-31315 json

Improper validation in a model specific register (MSR) could allow a malicious program with ring0 access to modify SMM configuration while…

published 2024-08-09 2 y ago modified 2026-06-17 4 mo ago also EUVD-2023-35626

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 50%
public exploits
0
none known

Summary

Improper validation in a model specific register (MSR) could allow a malicious program with ring0 access to modify SMM configuration while SMI lock is enabled, potentially leading to arbitrary code execution.

Patch / fix

  • AMD 3rd Gen AMD EPYC™ Processors Milan PI 1.0.0.D
  • AMD 1st Gen AMD EPYC™ Processors Naples PI 1.0.0.M
  • AMD 2nd Gen AMD EPYC™ Processors Rome PI 1.0.0.J
  • AMD AMD Ryzen™ 7000 Series Desktop Processors ComboAM5PI 1.2.0.1
  • AMD AMD Ryzen™ 4000 Series Desktop Processors with Radeon™ Graphics ComboAM4v2PI 1.2.0.cb
  • AMD AMD Ryzen™ Threadripper™ 3000 Series Processors CastlePeakPI-SP3r3 1.0.0.B
  • AMD AMD Ryzen™ Threadripper™ PRO Processors ChagallWSPI-sWRX8 1.0.0.8
  • AMD AMD Ryzen™ 3000 Series Mobile Processor with Radeon™ Graphics Picasso-FP5 1.0.1.2
  • AMD AMD Ryzen™ 7030 Series Mobile Processors with Radeon™ Graphics CezannePI-FP6
  • AMD AMD Ryzen™ 7020 Series Processors with Radeon™ Graphics MendocinoPI-FT6 1.0.0.7
  • amd 1st_gen_amd_epyc_processors naples.pi.1.0.0.m
  • amd 3rd_gen_amd_epyc_processors milan.pi.1.0.0.d
  • amd 2nd_gen_amd_epyc_processors rome.pi.1.0.0.j
  • amd 4th_gen_amd_epyc_processors genoa_pi_1.0.0.c
  • amd64-microcode Debian 12 3.20240710.2~deb12u1
  • amd64-microcode Debian 14, Debian 13 3.20240710.1

debian advisories DEBIAN-CVE-2023-31315

  • amd64-microcode Ubuntu 20.04 LTS 3.20191218.1ubuntu1.3
  • amd64-microcode Ubuntu 22.04 LTS 3.20191218.1ubuntu2.3
  • amd64-microcode Ubuntu 24.04 LTS 3.20231019.1ubuntu2.1
  • amd64-microcode Ubuntu Pro 16.04 LTS 3.20191021.1+really3.20180524.1~ubuntu0.16.04.2+esm3
  • amd64-microcode Ubuntu Pro 18.04 LTS 3.20191021.1+really3.20181128.1~ubuntu0.18.04.1+esm3

ubuntu advisories UBUNTU-CVE-2023-31315

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • linux-firmware RHEL 9 20240716-143.2.el9_4
  • iwl100-firmware RHEL 9 39.31.5.1-143.2.el9_4
  • iwl105-firmware RHEL 9 18.168.6.1-143.2.el9_4
  • iwl135-firmware RHEL 9 18.168.6.1-143.2.el9_4
  • iwl1000-firmware RHEL 9 1:39.31.5.1-143.2.el9_4
  • iwl2000-firmware RHEL 9 18.168.6.1-143.2.el9_4
  • iwl2030-firmware RHEL 9 18.168.6.1-143.2.el9_4
  • iwl3160-firmware RHEL 9 1:25.30.13.0-143.2.el9_4

red hat advisories RHBA-2024:5645RHBA-2024:6169RHSA-2024:7481RHBA-2024:6202RHSA-2024:5980RHSA-2024:5982

  • kernel-firmware Linux Micro 6.1 20241128-slfo.1.1_1.1
  • kernel-firmware Linux Micro 6.0 20241128-1.1
  • kernel-firmware SLE Module for Basesystem 15 SP6, openSUSE Leap 15.6 20241128-150600.3.9.1
  • kernel-firmware SLE Module for Basesystem 15 SP5, SLE Micro 5.5, openSUSE Leap Micro 5.5 +1 more 20230724-150500.3.12.1
  • kernel-firmware SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE Micro 5.4 +5 more 20220509-150400.4.28.1
  • kernel-firmware SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE Micro 5.2 +3 more 20210208-150300.4.22.1
  • kernel-firmware SLES for SAP 12 SP5, SLES 12 SP5 20190618-5.37.1
  • kernel-firmware SLES for SAP 15 SP2, SLES 15 SP2-LTSS, SLE High Performance Computing 15 SP2-LTSS 20200107-150100.3.43.1

suse advisories SUSE-SU-2025:20227-1SUSE-SU-2025:20129-1SUSE-SU-2024:4255-1SUSE-SU-2024:3081-1SUSE-SU-2024:2980-1SUSE-SU-2024:2944-1

  • spectre-meltdown-checker openSUSE Tumbleweed 26.36.0602723-1.1
  • kernel-firmware openSUSE Tumbleweed 20240809-1.1

opensuse advisories openSUSE-SU-2026:11242-1openSUSE-SU-2024:14266-1

  • linux-firmware Rocky Linux 8 20240827-124.git3cff7109.el8_10

rocky linux advisories RLSA-2024:7481

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-31315 updated cvss 7.5

hw: amd: SMM Lock Bypass

  • Red Hat Enterprise Linux 6 linux-firmware
    affected: workaround, no fix available
  • Red Hat Enterprise Linux BaseOS (v. 8) iwl100-firmware 39.31.5.1-124.el8_10.1, iwl5150-firmware 8.24.2.2-124.el8_10.1, iwl1000-firmware 39.31.5.1-124.el8_10.1, iwl105-firmware 18.168.6.1-124.el8_10.1, iwl135-firmware 18.168.6.1-124.el8_10.1, iwl3945-firmware 15.32.2.9-124.el8_10.1, +15 more
    fixed: vendor fix RHSA-2024:7481
  • Red Hat Enterprise Linux BaseOS (v. 9) linux-firmware 20240716-143.2.el9_4, iwl100-firmware 39.31.5.1-143.2.el9_4, iwl5150-firmware 8.24.2.2-143.2.el9_4, iwl1000-firmware 39.31.5.1-143.2.el9_4, iwl105-firmware 18.168.6.1-143.2.el9_4, iwl135-firmware 18.168.6.1-143.2.el9_4, +11 more
    fixed: vendor fix RHBA-2024:6169
  • Red Hat Enterprise Linux BaseOS AUS (v. 8.2) iwl100-firmware 39.31.5.1-102.2.el8_2.1, iwl5150-firmware 8.24.2.2-102.2.el8_2.1, iwl1000-firmware 39.31.5.1-102.2.el8_2.1, iwl105-firmware 18.168.6.1-102.2.el8_2.1, iwl135-firmware 18.168.6.1-102.2.el8_2.1, iwl3945-firmware 15.32.2.9-102.2.el8_2.1, +15 more
    fixed: vendor fix RHSA-2024:5883
  • Red Hat Enterprise Linux BaseOS E4S (v.9.0) linux-firmware 20220209-131.el9_0, iwl100-firmware 39.31.5.1-131.el9_0, iwl5150-firmware 8.24.2.2-131.el9_0, iwl1000-firmware 39.31.5.1-131.el9_0, iwl105-firmware 18.168.6.1-131.el9_0, iwl135-firmware 18.168.6.1-131.el9_0, +11 more
    fixed: vendor fix RHSA-2024:5980
  • Red Hat Enterprise Linux BaseOS EUS (v.8.8) iwl100-firmware 39.31.5.1-118.2.el8_8.1, iwl5150-firmware 8.24.2.2-118.2.el8_8.1, iwl1000-firmware 39.31.5.1-118.2.el8_8.1, iwl105-firmware 18.168.6.1-118.2.el8_8.1, iwl135-firmware 18.168.6.1-118.2.el8_8.1, iwl3945-firmware 15.32.2.9-118.2.el8_8.1, +15 more
    fixed: vendor fix RHBA-2024:6202
  • Red Hat Enterprise Linux BaseOS EUS (v.9.2) linux-firmware 20240716-138.2.el9_2, iwl100-firmware 39.31.5.1-138.2.el9_2, iwl5150-firmware 8.24.2.2-138.2.el9_2, iwl1000-firmware 39.31.5.1-138.2.el9_2, iwl105-firmware 18.168.6.1-138.2.el9_2, iwl135-firmware 18.168.6.1-138.2.el9_2, +11 more
    fixed: vendor fix RHBA-2024:5645
  • Red Hat Enterprise Linux Server (v. 7 ELS) iwl100-firmware 39.31.5.1-84.el7_9, iwl5150-firmware 8.24.2.2-84.el7_9, iwl1000-firmware 39.31.5.1-84.el7_9, iwl105-firmware 18.168.6.1-84.el7_9, iwl135-firmware 18.168.6.1-84.el7_9, iwl3945-firmware 15.32.2.9-84.el7_9, +11 more
    fixed: vendor fix RHSA-2024:5978
show 2 more
  • Red Hat Enterprise Linux Server AUS (v. 7.7) iwl100-firmware 39.31.5.1-76.el7_7, iwl3160-firmware 22.0.7.0-76.el7_7, iwl5150-firmware 8.24.2.2-76.el7_7, iwl7260-firmware 22.0.7.0-76.el7_7, iwl7265-firmware 22.0.7.0-76.el7_7, iwl1000-firmware 39.31.5.1-76.el7_7, +12 more
    fixed: vendor fix RHSA-2024:5982
  • Red Hat Enterprise Linux 10 linux-firmware
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-25-044-09 updated cvss 7.5

Siemens SCALANCE W700 IEEE 802.11ax

  • Siemens SCALANCE WAB762-1 (6GK5762-1AJ00-6AA0) <V3.0.0 Siemens SCALANCE WAM763-1 (6GK5763-1AL00-7DA0) <V3.0.0 Siemens SCALANCE WAM763-1 (ME) (6GK5763-1AL00-7DC0) <V3.0.0 Siemens SCALANCE WAM763-1 (US) (6GK5763-1AL00-7DB0) <V3.0.0 Siemens SCALANCE WAM766-1 (6GK5766-1GE00-7DA0) <V3.0.0 Siemens SCALANCE WAM766-1 (ME) (6GK5766-1GE00-7DC0) <V3.0.0
    +13 more products
    Siemens SCALANCE WAM766-1 (US) (6GK5766-1GE00-7DB0) <V3.0.0 Siemens SCALANCE WAM766-1 EEC (6GK5766-1GE00-7TA0) <V3.0.0 Siemens SCALANCE WAM766-1 EEC (ME) (6GK5766-1GE00-7TC0) <V3.0.0 Siemens SCALANCE WAM766-1 EEC (US) (6GK5766-1GE00-7TB0) <V3.0.0 Siemens SCALANCE WUB762-1 (6GK5762-1AJ00-1AA0) <V3.0.0 Siemens SCALANCE WUB762-1 iFeatures (6GK5762-1AJ00-2AA0) <V3.0.0 Siemens SCALANCE WUM763-1 (6GK5763-1AL00-3AA0) <V3.0.0 Siemens SCALANCE WUM763-1 (6GK5763-1AL00-3DA0) <V3.0.0 Siemens SCALANCE WUM763-1 (US) (6GK5763-1AL00-3AB0) <V3.0.0 Siemens SCALANCE WUM763-1 (US) (6GK5763-1AL00-3DB0) <V3.0.0 Siemens SCALANCE WUM766-1 (6GK5766-1GE00-3DA0) <V3.0.0 Siemens SCALANCE WUM766-1 (ME) (6GK5766-1GE00-3DC0) <V3.0.0 Siemens SCALANCE WUM766-1 (USA) (6GK5766-1GE00-3DB0) <V3.0.0
    affected: fixed in V3.0.0 support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
2 y ago

Exploit prediction

0.63% chance of exploitation in the next 30 days, higher than 50% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
CISA ADP 3.1 6.8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
CNA 3.1 6.8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

Affected products

  • AMD 3rd Gen AMD EPYC™ Processors
  • AMD 1st Gen AMD EPYC™ Processors
  • AMD 2nd Gen AMD EPYC™ Processors
  • AMD 4th Gen AMD EPYC™ Processors
  • AMD AMD EPYC™ Embedded 3000
  • AMD AMD EPYC™ Embedded 7002
  • AMD AMD EPYC™ Embedded 7003
  • AMD AMD EPYC™ Embedded 9003
  • AMD AMD Ryzen™ Embedded R1000
  • AMD AMD Ryzen™ Embedded R2000
  • AMD AMD Ryzen™ Embedded 5000
  • AMD AMD Ryzen™ Embedded 7000
  • AMD AMD Ryzen™ Embedded V1000
  • AMD AMD Ryzen™ Embedded V2000
  • AMD AMD Ryzen™ Embedded V3000
  • AMD AMD Ryzen™ 3000 Series Desktop Processors
  • AMD AMD Ryzen™ 5000 Series Desktop Processors
  • AMD AMD Ryzen™ 5000 Series Desktop processor with Radeon™ Graphics
  • AMD AMD Ryzen™ 7000 Series Desktop Processors
  • AMD AMD Ryzen™ 4000 Series Desktop Processors with Radeon™ Graphics
  • AMD AMD Ryzen™ Threadripper™ 3000 Series Processors
  • AMD AMD Ryzen™ Threadripper™ PRO Processors
  • AMD AMD Ryzen™ Threadripper™ PRO 3000WX Series Processors
  • AMD AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics
  • AMD AMD Ryzen™ 3000 Series Mobile Processor with Radeon™ Graphics
  • AMD AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics
  • AMD AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics
  • AMD AMD Ryzen™ 7030 Series Mobile Processors with Radeon™ Graphics
  • AMD AMD Ryzen™ 7040 Series Mobile Processors with Radeon™ Graphics
  • AMD AMD Ryzen™ 7045 Series Mobile Processors
  • AMD AMD Ryzen™ 6000 Series Processors with Radeon™ Graphics
  • AMD AMD Ryzen™ 7020 Series Processors with Radeon™ Graphics
  • AMD AMD Ryzen™ 7035 Series Processors with Radeon™ Graphics
  • AMD AMD Ryzen™ 8000 Series Processors with Radeon™ Graphics
  • amd 1st_gen_amd_epyc_processors
  • amd 3rd_gen_amd_epyc_processors
  • amd 2nd_gen_amd_epyc_processors
  • amd ryzen_3000_series_desktop_processors
  • amd 4th_gen_amd_epyc_processors
  • amd epyc_embedded_3000
  • amd epyc_embedded_7002
  • amd epyc_embedded_7003
  • amd epyc_embedded_9003
  • amd ryzen_embedded_r1000
  • amd ryzen_embedded_r2000
  • amd ryzen_embedded_7000
  • amd ryzen_embedded_5000
  • amd ryzen_embedded_v1000
  • amd ryzen_embedded_v3000
  • amd ryzen_embedded_v2000

Classification

Weakness
  • CWE-94 Improper Control of Generation of Code

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.