What is CVE-2023-20570?

CVE-2023-20570 is a low-severity vulnerability in Amd Alveo™ Card (Ultrascale™and Ultrascale+™ Based), classified under Insufficient Verification of Data Authenticity. CVSS score: 3.3/10. Published 2024-02-13.

How severe is CVE-2023-20570?

Low severity. CVSS v3 base score is 3.3 out of 10.

Is CVE-2023-20570 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Amd Alveo™ Card (Ultrascale™and Ultrascale+™ Based)

CVE-2023-20570

Insufficient verification of data authenticity in the configuration state machine may allow a local attacker to potentially load arbitrary bitstreams.

EPSS: 0.001 (1.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 3.3 (Low). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N.

Affected products

Amd Alveo™ Card (Ultrascale™and Ultrascale+™ Based) — versions all
Amd Alveo_u200
Amd Alveo_u200_firmware
Amd Alveo_u250
Amd Alveo_u250_firmware
Amd Alveo_u280
Amd Alveo_u280_firmware
Amd Alveo_u50
Amd Alveo_u50_firmware
Amd Artix™ Ultrascale+™ Fpga — versions all

Weakness classification (CWE)

CWE-345 — Insufficient Verification of Data Authenticity

Public proof-of-concept exploits

emsec/ConFuzz

References

psirt@amd.com (Vendor Advisory)

Frequently asked questions

What is CVE-2023-20570?: CVE-2023-20570 is a low-severity vulnerability in Amd Alveo™ Card (Ultrascale™and Ultrascale+™ Based), classified under Insufficient Verification of Data Authenticity. CVSS score: 3.3/10. Published 2024-02-13.
How severe is CVE-2023-20570?: Low severity. CVSS v3 base score is 3.3 out of 10.
Is CVE-2023-20570 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.