Skip to content
Fencer Intel
critical 9.8

CVE-2022-23821 json

Improper access control in System Management Mode (SMM) may allow an attacker to write to SPI ROM potentially leading to arbitrary code exe…

published 2y ago modified 4mo ago also EUVD-2022-28750

cvss
9.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.0%
EPSS 1.0% chance of exploitation in 30 days, percentile 62%
public exploits
0
none known

Summary

Improper access control in System Management Mode (SMM) may allow an attacker to write to SPI ROM potentially leading to arbitrary code execution.

Is CVE-2022-23821 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
2y ago

Exploit prediction

0.99% chance of exploitation in the next 30 days, higher than 62% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

  • AMD Ryzen™ 3000 Series Desktop Processors “Matisse”
  • AMD Ryzen™ 5000 Series Desktop Processors “Vermeer”
  • AMD Ryzen™ 5000 Series Desktop Processor with Radeon™ Graphics “Cezanne”
  • AMD Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics “Picasso” AM4
  • AMD Ryzen™ Threadripper™ 2000 Series Processors “Colfax”
  • AMD Ryzen™ Threadripper™ 3000 Series Processors “Castle Peak” HEDT
  • AMD Ryzen™ Threadripper™ PRO Processors “Castle Peak” WS SP3
  • AMD Ryzen™ Threadripper™ PRO 3000WX Series Processors “Chagall” WS
  • AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics “Dali”/”Dali” FP5
  • AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics “Pollock”
  • AMD Ryzen™ 3000 Series Mobile Processor with Radeon™ Graphics “Picasso” FP5
  • AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics “Renoir” FP6
  • AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics “Lucienne”
  • AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics “Cezanne”
  • AMD AMD Ryzen™ 6000 Series Processors with Radeon™ Graphics "Rembrandt"
  • AMD AMD Ryzen™ 7035 Series Processors with Radeon™ Graphics “Rembrandt-R”
  • AMD AMD Ryzen™ 5000 Series Processors with Radeon™ Graphics “Barcelo”
  • AMD AMD Ryzen™ 7030 Series Mobile Processors with Radeon™ Graphics “Barcelo-R”
  • AMD AMD Ryzen™ Embedded R1000
  • AMD AMD Ryzen™ Embedded R2000
  • AMD AMD Ryzen™ Embedded 5000
  • AMD AMD Ryzen™ Embedded V1000
  • AMD AMD Ryzen™ Embedded V2000
  • AMD AMD Ryzen™ Embedded V3000

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.