CVE-2022-23829

Firmware-integrity loss via SPI lock bypass

Published Jun 18, 2024 · Updated Aug 29, 2024

Improper access control in AMD processor SPI protections allows local users with kernel privileges to bypass SMM ROM protections. The public advisory identifies the affected protection layer but does not disclose which lock, register, or validation operation fails. Ring0 access is required; bypassing the protection can undermine firmware integrity and availability, with no remote or low-privilege path reported.

CVSS severity8.2
High
EPSS probability0.20%
Next 30 days · Sep 16, 2026
Known exploitationUnconfirmed
Based on sourced intelligence
Hinoki checkNot available
Coverage for this vulnerability

See if you're affected

Explore vulnerability checks for your environment with Hinoki.

Book a demo

Summary

What happened

Improper access control in AMD processor SPI protections allows local users with kernel privileges to bypass SMM ROM protections. The public advisory identifies the affected protection layer but does not disclose which lock, register, or validation operation fails. Ring0 access is required; bypassing the protection can undermine firmware integrity and availability, with no remote or low-privilege path reported.

The record

CVE
CVE-2022-23829
Published
Jun 18, 2024
Updated
Aug 29, 2024
Vendor
Advanced Micro Devices, Inc.
Product
AMD Ryzen™ 7000 Series Desktop Processors
Classifications
CWE-284, T1542.001
Attack vector
local
Privileges
admin

Timeline

How it unfolded

  1. Jun 18, 2024CVE publishedPublication date reported by the CVE source.
  2. Aug 29, 2024Record updatedLatest update available in the CVE record.

Exploitability

Present is not the same as exploitable

Compare your product and version with the public record. A matching version still requires validation against your environment.

Is a vulnerable build present?

Compare these published version ranges with your installed build and any vendor patches.

  1. Affected versionversion=various

What conditions does exploitation require?

Attack vectorlocal
Required privilegesadmin

What is affected?

Advanced Micro Devices, Inc. · AMD Ryzen™ 7000 Series Desktop Processorsversion=various
Advanced Micro Devices, Inc. · AMD Ryzen Threadripper PRO 5000WX Processorsversion=various
Advanced Micro Devices, Inc. · AMD Ryzen™ Embedded R2000 Series Processorsversion=various
Advanced Micro Devices, Inc. · AMD EPYC Embedded 7003 Series Processorsversion=various
Advanced Micro Devices, Inc. · AMD Ryzen Threadripper PRO Processorsversion=various
Advanced Micro Devices, Inc. · AMD Ryzen Embedded V3000 Seriesversion=various
Advanced Micro Devices, Inc. · AMD EPYC 7003 Processorsversion=various
Advanced Micro Devices, Inc. · AMD EPYC Embedded 7002 Series Processorsversion=various
Advanced Micro Devices, Inc. · AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphicsversion=various
Advanced Micro Devices, Inc. · AMD Ryzen 9 6980HXversion=0 <*
Advanced Micro Devices, Inc. · AMD Ryzen 6000 Series Mobile Processors and Workstationsversion=various
Advanced Micro Devices, Inc. · AMD Ryzen Embedded V2000 Series Processorsversion=various
Advanced Micro Devices, Inc. · AMD EPYC Embedded 3000 Series Processorsversion=various
Advanced Micro Devices, Inc. · AMD Ryzen 5000 Series Mobile Processorsversion=various
Advanced Micro Devices, Inc. · AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphicsversion=various
Advanced Micro Devices, Inc. · AMD Ryzen Embedded V1000version=various
Advanced Micro Devices, Inc. · AMD Ryzen™ 4000 Series Desktop Processors with Radeon™ Graphicsversion=various
Advanced Micro Devices, Inc. · AMD EPYC™ 7001 Series Processorsversion=various
Advanced Micro Devices, Inc. · AMD Ryzen 4000 Series Mobile Processorsversion=various
Advanced Micro Devices, Inc. · AMD EPYC 7002 Series Processorsversion=various
Advanced Micro Devices, Inc. · AMD Ryzen Embedded 5000version=various
Advanced Micro Devices, Inc. · AMD Ryzen Embedded R1000version=various
Advanced Micro Devices, Inc. · AMD Ryzen Threadripper PRO 5995WXversion=0 <*
Advanced Micro Devices, Inc. · AMD Ryzen™ 3000 Series Desktop Processorsversion=various
Advanced Micro Devices, Inc. · AMD Ryzen™ 5000 Series Desktop Processorsversion=various

Published CVSS scores

8.2Advanced Micro Devices, Inc.CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CVSS describes severity. EPSS estimates exploitation probability.

Attacks

What attackers are doing with it

Daily unique IPs observed by Shadowserver honeypots for known exploited vulnerabilities (KEVs). Missing observations do not establish an absence of attacks.

Daily unique IPsNo honeypot observations are available for this CVE in the selected window.

No observations available

Sep 9, 2026Sep 15, 2026
Latest reporting daySep 15, 2026
Latest daily unique IPsUnavailable
Prior 30-day averageUnavailable
SourceShadowserver honeypots (KEV)
Vectorlocal
Privilegesadmin
Known exploitationUnconfirmed
Public exploitUnconfirmed

Weakness, pattern, technique

CWE-284Improper Access Control
T1542.001Pre-OS Boot: System Firmware

Public exploit references

No public exploit references are available in this record.

Labels summarize the accepted research assessment. They do not indicate a test against your environment.

Technologies

Your stack

See the directory against your own environment.

Your stack

Check the software in your environment

Book a demo to see how Hinoki identifies affected software and validates exploitability in your environment.

Book a demo