What is CVE-2023-31347?

CVE-2023-31347 is a medium-severity vulnerability in Amd 3rd Gen Epyc™ Processors, classified under Incorrect Calculation. CVSS score: 4.9/10. Published 2024-02-13.

How severe is CVE-2023-31347?

Medium severity. CVSS v3 base score is 4.9 out of 10.

Vulnerability in Amd 3rd Gen Epyc™ Processors

CVE-2023-31347

Due to a code bug in Secure_TSC, SEV firmware may allow an attacker with high privileges to cause a guest to observe an incorrect TSC when Secure TSC is enabled potentially resulting in a loss of guest integrity.

EPSS: 0.005 (37.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.9 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N.

Affected products

Amd 3rd Gen Epyc™ Processors — versions various
Amd 4th Gen Epyc™ Processors — versions various
Amd Epyc_7203_firmware
Amd Epyc_7203p
Amd Epyc_7203p_firmware
Amd Epyc_72f3
Amd Epyc_72f3_firmware
Amd Epyc_7303
Amd Epyc_7303_firmware
Amd Epyc_7303p

Weakness classification (CWE)

CWE-682 — Incorrect Calculation

References

psirt@amd.com (vendor-advisory, Broken Link)

Frequently asked questions

What is CVE-2023-31347?: CVE-2023-31347 is a medium-severity vulnerability in Amd 3rd Gen Epyc™ Processors, classified under Incorrect Calculation. CVSS score: 4.9/10. Published 2024-02-13.
How severe is CVE-2023-31347?: Medium severity. CVSS v3 base score is 4.9 out of 10.