CVE-2022-23821
📋 TL;DR
This vulnerability allows attackers with local access to bypass System Management Mode (SMM) protections and write to SPI ROM, potentially leading to arbitrary code execution with high privileges. It affects AMD processors with specific firmware versions. Attackers could gain persistent control over affected systems.
💻 Affected Systems
- AMD processors with affected firmware
📦 What is this software?
Ryzen Threadripper 2970wx Firmware by Amd
View all CVEs affecting Ryzen Threadripper 2970wx Firmware →
Ryzen Threadripper 2990wx Firmware by Amd
View all CVEs affecting Ryzen Threadripper 2990wx Firmware →
Ryzen Threadripper Pro 3945wx Firmware by Amd
View all CVEs affecting Ryzen Threadripper Pro 3945wx Firmware →
Ryzen Threadripper Pro 3955wx Firmware by Amd
View all CVEs affecting Ryzen Threadripper Pro 3955wx Firmware →
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with persistent firmware-level malware that survives OS reinstallation and disk replacement, enabling long-term espionage or destruction.
Likely Case
Local privilege escalation allowing attackers to bypass security controls, install rootkits, or steal sensitive data from protected memory regions.
If Mitigated
Limited impact if proper access controls and firmware protections are in place, though risk remains for physical access scenarios.
🎯 Exploit Status
Exploitation requires local access and deep knowledge of SMM/SPI ROM. No public exploits known as of analysis date.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firmware updates specified in AMD-SB-4002 and AMD-SB-5001
Vendor Advisory: https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-4002
Restart Required: Yes
Instructions:
1. Identify AMD processor model and current firmware version. 2. Check AMD advisories for affected status. 3. Download appropriate firmware update from motherboard/system manufacturer. 4. Apply firmware update following manufacturer instructions. 5. Reboot system to activate new firmware.
🔧 Temporary Workarounds
Physical Security Controls
allRestrict physical access to systems to prevent local exploitation
Privilege Access Management
allImplement strict controls on local administrative access
🧯 If You Can't Patch
- Isolate affected systems in secure network segments
- Implement strict physical security controls and access monitoring
🔍 How to Verify
Check if Vulnerable:
Check system BIOS/UEFI firmware version and compare against AMD advisory lists. Use manufacturer-specific tools to identify firmware version.Check Version:
Manufacturer-specific commands vary. Common: Windows: wmic bios get smbiosbiosversion, Linux: dmidecode -t biosVerify Fix Applied:
Verify firmware version after update matches patched versions in AMD advisories. Confirm no unauthorized SPI ROM modifications.📡 Detection & Monitoring
Log Indicators:
- Unexpected firmware update attempts
- Unauthorized SMM access attempts
- SPI ROM write operations
Network Indicators:
- None - local exploitation only
SIEM Query:
Search for firmware modification events, unauthorized local access patterns, or SMM-related security alerts