CVE-2023-20555

HIGH

7.8

CVSS Score

Published: August 8, 2023 at 05:07 PM UTC

Updated: June 17, 2026 at 05:30 AM UTC

244 products affected across 1 vendorRyzen 5 5600HS FirmwareRyzen 5 5600U FirmwareRyzen 5 5600H Firmware

Using Ryzen™ 3000 Series Desktop Processors “Matisse” AM4 by AMD?

Get instant alerts when new vulnerabilities affect Ryzen™ 3000 Series Desktop Processors “Matisse” AM4 - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.8

Exploit prediction

EPSS 0.3%

SSVC

No known exploit

Description

Insufficient input validation in CpmDisplayFeatureSmm may allow an attacker to corrupt SMM memory by overwriting an arbitrary bit in an attacker-controlled pointer potentially leading to arbitrary code execution in SMM.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Athlon 3015CE Firmware · AMD

95%

v < pollockpi-ft5_1.0.0.5

Affected range stops below pollockpi-ft5_1.0.0.5, so it looks safe — our inference, not a vendor statement

amd-athlon-3015ce (same device)

Athlon 3015E Firmware · AMD

95%

v < pollockpi-ft5_1.0.0.5

Affected range stops below pollockpi-ft5_1.0.0.5, so it looks safe — our inference, not a vendor statement

amd-athlon-3015e (same device)

Athlon Gold 3150C Firmware · AMD

95%

v < picassopi-fp5_1.0.0.f

Affected range stops below picassopi-fp5_1.0.0.f, so it looks safe — our inference, not a vendor statement

amd-athlon-gold-3150c (same device)

Athlon Gold 3150G Firmware · AMD

95%

v < comboam4piv1_1.0.0.av < comboam4v2_1.2.0.a

Affected range stops below comboam4piv1_1.0.0.a, so it looks safe — our inference, not a vendor statement

Affected range stops below comboam4v2_1.2.0.a, so it looks safe — our inference, not a vendor statement

amd-athlon-gold-3150g (same device)

Athlon Gold 3150GE Firmware · AMD

95%

v < comboam4piv1_1.0.0.av < comboam4v2_1.2.0.a

Affected range stops below comboam4piv1_1.0.0.a, so it looks safe — our inference, not a vendor statement

Affected range stops below comboam4v2_1.2.0.a, so it looks safe — our inference, not a vendor statement

amd-athlon-gold-3150ge (same device)

Athlon Gold 3150U Firmware · AMD

95%

v < picassopi-fp5_1.0.0.f

Affected range stops below picassopi-fp5_1.0.0.f, so it looks safe — our inference, not a vendor statement

amd-athlon-gold-3150u (same device)

Athlon Gold Pro 3150G Firmware · AMD

95%

v < comboam4piv1_1.0.0.av < comboam4v2_1.2.0.a

Affected range stops below comboam4piv1_1.0.0.a, so it looks safe — our inference, not a vendor statement

Affected range stops below comboam4v2_1.2.0.a, so it looks safe — our inference, not a vendor statement

amd-athlon-gold-pro-3150g (same device)

Athlon Gold Pro 3150GE Firmware · AMD

95%

v < comboam4piv1_1.0.0.av < comboam4v2_1.2.0.a

Affected range stops below comboam4piv1_1.0.0.a, so it looks safe — our inference, not a vendor statement

Affected range stops below comboam4v2_1.2.0.a, so it looks safe — our inference, not a vendor statement

amd-athlon-gold-pro-3150ge (same device)

Athlon PRO 300GE · AMD

95%

v < comboam4piv1_1.0.0.av < comboam4v2_1.2.0.a

Affected range stops below comboam4piv1_1.0.0.a, so it looks safe — our inference, not a vendor statement

Affected range stops below comboam4v2_1.2.0.a, so it looks safe — our inference, not a vendor statement

Athlon Pro 3045B Firmware · AMD

95%

v < picassopi-fp5_1.0.0.f

Affected range stops below picassopi-fp5_1.0.0.f, so it looks safe — our inference, not a vendor statement

amd-athlon-pro-3045b (same device)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-4003

References (1)

Vendor Advisory

Source: [email protected]

https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-4003

SSVC — Action Prioritization

SSVCNo known exploitNot automatableTotal impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

7.8HIGH[email protected]

Attack Vector: LOCAL
Complexity: LOW
Privileges: LOW
User Interaction: NONE
Scope: UNCHANGED
Confidentiality: HIGH
Integrity: HIGH
Availability: HIGH

Vector?

Quick Info

StatusMODIFIED

CWE

CWE-787

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card