ASP Secure OS: Privilege Escalation via Buffer Overflow in TA
CVE-2022-23817 Published on August 13, 2024
Insufficient checking of memory buffer in AMD Secure Processor (ASP) Secure OS may allow an attacker with a malicious trusted application to read/write to the ASP Secure OS kernel virtual address space, potentially resulting in privilege escalation.
Weakness Types
Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
What is a Classic Buffer Overflow Vulnerability?
The program copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. A buffer overflow condition exists when a program attempts to put more data in a buffer than it can hold, or when a program attempts to put data in a memory area outside of the boundaries of a buffer. The simplest type of error, and the most common cause of buffer overflows, is the "classic" case in which the program copies the buffer without restricting how much is copied. Other variants exist, but the existence of a classic overflow strongly suggests that the programmer is not considering even the most basic of security protections.
CVE-2022-23817 has been classified to as a Classic Buffer Overflow vulnerability or weakness.
Products Associated with CVE-2022-23817
Want to know whenever a new CVE is published for AMD products? stack.watch will email you.
Affected Versions
AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics:- Version PicassoPI-FP5 1.0.0.E is unaffected.
- Version ChagallWSPI-sWRX8 1.0.0.5 is unaffected.
- Version CastlePeakWSPI-sWRX8 1.0.0.A is unaffected.
- Version ComboAM4v2 PI 1.2.0.8 is unaffected.
- Version ChagallWSPI-sWRX8 1.0.0.5 is unaffected.
- Version RenoirPI-FP6 1.0.0.A is unaffected.
- Version PicassoPI-FP5 1.0.0.E is unaffected.
- Version CezannePI-FP6 1.0.0.C is unaffected.
- Version ComboAM4V1 1.0.0.A is unaffected.
- Version ComboAM4V2 1.2.0.9 is unaffected.
- Version ComboAM4v2 PI 1.2.0.8 is unaffected.
- Version ComboAM4PI 1.0.0.9 is unaffected.
- Version ComboAM4v2 PI 1.2.0.8 is unaffected.
- Version ComboAM4v2 PI 1.2.0.8 is unaffected.
- Version RembrandtPI-FP7_1.0.0.5 is unaffected.
- Version EmbeddedPI-FP5_1.2.0.A is unaffected.
- Version EmbeddedR2KPI-FP5 1.0.0.2 is unaffected.
- Version EmbAM4PI 1.0.0.2 is unaffected.
- Version EmbeddedPI-FP5_1.2.0.A is unaffected.
- Version EmbeddedPI-FP5_1.2.0.A is unaffected.
- Version EmbeddedPI-FP6_1.0.0.8 is unaffected.
- Version EmbeddedPI-FP7r2_1002 is unaffected.
- Version AMD Software: Adrenalin Edition 22.5.2 (22.10.17.01) is unaffected.
- Version AMD Software: PRO Edition 22.Q2 (22.10.20) is unaffected.
- Version AMD Software: Adrenalin Edition 22.5.2 (22.10.17.01) is unaffected.
- Version AMD Software: PRO Edition 22.Q2 (22.10.20) is unaffected.
- Version No fix planned is unaffected.
- Version ROCm 6.4.2 is unaffected.
- Version ROCm 7.0 is unaffected.
- Version ROCm 7.0 is unaffected.
- Before comboam4v2_1.2.0.a is unaffected.
- Before picassopi-fp5_1.0.0.e is unaffected.
- Before comboam4v2_pi_1.2.0.8 is unaffected.
- Before comboam5_1.0.8.0 is unaffected.
- Before castlepeakpi-sp3r3_1.0.0.8 is unaffected.
- Before castlepeakwspi-swrx8_1.0.0.a is unaffected.
- Before chagallwspi-swrx8_1.0.0.5 is unaffected.
- Before renoirpi-fp6_1.0.0.a is unaffected.
- Before rembrandtpi-fp7_1.0.0.5 is unaffected.
- Before rembrandtpi-fp7_1.0.0.5 is unaffected.
- Before dragonrangefl1pi_1.0.0.3b is unaffected.
- Before comboam4v2_pi_1.2.0.8 is unaffected.
- Before cezannepi-fp6_1.0.0.c is unaffected.
- Before cezannepi-fp6_1.0.0.c is unaffected.
- Before picassopi-fp5_1.0.0.e is unaffected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.