CVE-2022-23818 : Insufficient input validation on the model specific register: VM_HSAVE

Insufficient input validation on the model specific register: VM_HSAVE_PA may potentially lead to loss of SEV-SNP guest memory integrity.

Published 2023-05-09 19:15:11

Updated 2023-05-22 15:51:44

Source Advanced Micro Devices Inc.

View at NVD, CVE.org

Vulnerability category: Input validation

Products affected by CVE-2022-23818

AMD » Epyc 7763 Firmware » Version: Milanpi 1.0.0.9
cpe:2.3:o:amd:epyc_7763_firmware:milanpi_1.0.0.9:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 7763 » Version: N/A
AMD » Epyc 7713p Firmware » Version: Milanpi 1.0.0.9
cpe:2.3:o:amd:epyc_7713p_firmware:milanpi_1.0.0.9:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 7713p » Version: N/A
AMD » Epyc 7713 Firmware » Version: Milanpi 1.0.0.9
cpe:2.3:o:amd:epyc_7713_firmware:milanpi_1.0.0.9:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 7713 » Version: N/A
AMD » Epyc 7663 Firmware » Version: Milanpi 1.0.0.9
cpe:2.3:o:amd:epyc_7663_firmware:milanpi_1.0.0.9:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 7663 » Version: N/A
AMD » Epyc 7643 Firmware » Version: Milanpi 1.0.0.9
cpe:2.3:o:amd:epyc_7643_firmware:milanpi_1.0.0.9:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 7643 » Version: N/A
AMD » Epyc 75f3 Firmware » Version: Milanpi 1.0.0.9
cpe:2.3:o:amd:epyc_75f3_firmware:milanpi_1.0.0.9:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 75f3 » Version: N/A
AMD » Epyc 7543p Firmware » Version: Milanpi 1.0.0.9
cpe:2.3:o:amd:epyc_7543p_firmware:milanpi_1.0.0.9:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 7543p » Version: N/A
AMD » Epyc 7543 Firmware » Version: Milanpi 1.0.0.9
cpe:2.3:o:amd:epyc_7543_firmware:milanpi_1.0.0.9:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 7543 » Version: N/A
AMD » Epyc 7513 Firmware » Version: Milanpi 1.0.0.9
cpe:2.3:o:amd:epyc_7513_firmware:milanpi_1.0.0.9:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 7513 » Version: N/A
AMD » Epyc 7453 Firmware » Version: Milanpi 1.0.0.9
cpe:2.3:o:amd:epyc_7453_firmware:milanpi_1.0.0.9:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 7453 » Version: N/A
AMD » Epyc 74f3 Firmware » Version: Milanpi 1.0.0.9
cpe:2.3:o:amd:epyc_74f3_firmware:milanpi_1.0.0.9:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 74f3 » Version: N/A
AMD » Epyc 7443p Firmware » Version: Milanpi 1.0.0.9
cpe:2.3:o:amd:epyc_7443p_firmware:milanpi_1.0.0.9:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 7443p » Version: N/A
AMD » Epyc 7443 Firmware » Version: Milanpi 1.0.0.9
cpe:2.3:o:amd:epyc_7443_firmware:milanpi_1.0.0.9:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 7443 » Version: N/A
AMD » Epyc 7413 Firmware » Version: Milanpi 1.0.0.9
cpe:2.3:o:amd:epyc_7413_firmware:milanpi_1.0.0.9:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 7413 » Version: N/A
AMD » Epyc 73f3 Firmware » Version: Milanpi 1.0.0.9
cpe:2.3:o:amd:epyc_73f3_firmware:milanpi_1.0.0.9:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 73f3 » Version: N/A
AMD » Epyc 7343 Firmware » Version: Milanpi 1.0.0.9
cpe:2.3:o:amd:epyc_7343_firmware:milanpi_1.0.0.9:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 7343 » Version: N/A
AMD » Epyc 7313p Firmware » Version: Milanpi 1.0.0.9
cpe:2.3:o:amd:epyc_7313p_firmware:milanpi_1.0.0.9:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 7313p » Version: N/A
AMD » Epyc 7313 Firmware » Version: Milanpi 1.0.0.9
cpe:2.3:o:amd:epyc_7313_firmware:milanpi_1.0.0.9:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 7313 » Version: N/A
AMD » Epyc 72f3 Firmware » Version: Milanpi 1.0.0.9
cpe:2.3:o:amd:epyc_72f3_firmware:milanpi_1.0.0.9:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 72f3 » Version: N/A
AMD » Epyc 7773x Firmware » Version: Milanpi 1.0.0.9
cpe:2.3:o:amd:epyc_7773x_firmware:milanpi_1.0.0.9:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 7773x » Version: N/A
AMD » Epyc 7473x Firmware » Version: Milanpi 1.0.0.9
cpe:2.3:o:amd:epyc_7473x_firmware:milanpi_1.0.0.9:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 7473x » Version: N/A
AMD » Epyc 7573x Firmware » Version: Milanpi 1.0.0.9
cpe:2.3:o:amd:epyc_7573x_firmware:milanpi_1.0.0.9:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 7573x » Version: N/A
AMD » Epyc 7373x Firmware » Version: Milanpi 1.0.0.9
cpe:2.3:o:amd:epyc_7373x_firmware:milanpi_1.0.0.9:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 7373x » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2022-23818

EPSS FAQ

0.06%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 25 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-23818

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: High Availability: None

CWE ids for CVE-2022-23818

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2022-23818

https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-3001

Access Denied
Vendor Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2022-23818

Products affected by CVE-2022-23818

Exploit prediction scoring system (EPSS) score for CVE-2022-23818

CVSS scores for CVE-2022-23818

CWE ids for CVE-2022-23818

References for CVE-2022-23818