CVE & CISA-KEV Catalog

CVE-2023-20578

HIGH
7.5
CVSS v3
NVD

Description

A TOCTOU (Time-Of-Check-Time-Of-Use) in SMM may allow an attacker with ring0 privileges and access to the BIOS menu or UEFI shell to modify the communications buffer potentially resulting in arbitrary code execution.

CWE-367TOCTOU Race Condition

How to fix

Remediation Available
epyc 7001 firmwareNVD
Affected:< naplespi_1.0.0.kFixed in:naplespi_1.0.0.kCVE-2023-20578derived from NVD
epyc 7203 firmwareNVD
Affected:< milanpi_1.0.0.5Fixed in:milanpi_1.0.0.5CVE-2023-20578derived from NVD
epyc 7203p firmwareNVD
Affected:< milanpi_1.0.0.5Fixed in:milanpi_1.0.0.5CVE-2023-20578derived from NVD
epyc 7232p firmwareNVD
Affected:< romepi_1.0.0.gFixed in:romepi_1.0.0.gCVE-2023-20578derived from NVD
epyc 7251 firmwareNVD
Affected:< naplespi_1.0.0.kFixed in:naplespi_1.0.0.kCVE-2023-20578derived from NVD
epyc 7252 firmwareNVD
Affected:< romepi_1.0.0.gFixed in:romepi_1.0.0.gCVE-2023-20578derived from NVD
epyc 7261 firmwareNVD
Affected:< naplespi_1.0.0.kFixed in:naplespi_1.0.0.kCVE-2023-20578derived from NVD
epyc 7262 firmwareNVD
Affected:< romepi_1.0.0.gFixed in:romepi_1.0.0.gCVE-2023-20578derived from NVD
epyc 7272 firmwareNVD
Affected:< romepi_1.0.0.gFixed in:romepi_1.0.0.gCVE-2023-20578derived from NVD
epyc 7281 firmwareNVD
Affected:< naplespi_1.0.0.kFixed in:naplespi_1.0.0.kCVE-2023-20578derived from NVD
epyc 7282 firmwareNVD
Affected:< romepi_1.0.0.gFixed in:romepi_1.0.0.gCVE-2023-20578derived from NVD
epyc 72f3 firmwareNVD
Affected:< milanpi_1.0.0.5Fixed in:milanpi_1.0.0.5CVE-2023-20578derived from NVD
epyc 7301 firmwareNVD
Affected:< naplespi_1.0.0.kFixed in:naplespi_1.0.0.kCVE-2023-20578derived from NVD
epyc 7302 firmwareNVD
Affected:< romepi_1.0.0.gFixed in:romepi_1.0.0.gCVE-2023-20578derived from NVD
epyc 7302p firmwareNVD
Affected:< romepi_1.0.0.gFixed in:romepi_1.0.0.gCVE-2023-20578derived from NVD
epyc 7303 firmwareNVD
Affected:< milanpi_1.0.0.5Fixed in:milanpi_1.0.0.5CVE-2023-20578derived from NVD
epyc 7303p firmwareNVD
Affected:< milanpi_1.0.0.5Fixed in:milanpi_1.0.0.5CVE-2023-20578derived from NVD
epyc 7313 firmwareNVD
Affected:< milanpi_1.0.0.5Fixed in:milanpi_1.0.0.5CVE-2023-20578derived from NVD
epyc 7313p firmwareNVD
Affected:< milanpi_1.0.0.5Fixed in:milanpi_1.0.0.5CVE-2023-20578derived from NVD
epyc 7343 firmwareNVD
Affected:< milanpi_1.0.0.5Fixed in:milanpi_1.0.0.5CVE-2023-20578derived from NVD
epyc 7351 firmwareNVD
Affected:< naplespi_1.0.0.kFixed in:naplespi_1.0.0.kCVE-2023-20578derived from NVD
epyc 7351p firmwareNVD
Affected:< naplespi_1.0.0.kFixed in:naplespi_1.0.0.kCVE-2023-20578derived from NVD
epyc 7352 firmwareNVD
Affected:< romepi_1.0.0.gFixed in:romepi_1.0.0.gCVE-2023-20578derived from NVD
epyc 7371 firmwareNVD
Affected:< naplespi_1.0.0.kFixed in:naplespi_1.0.0.kCVE-2023-20578derived from NVD
epyc 7373x firmwareNVD
Affected:< milanpi_1.0.0.5Fixed in:milanpi_1.0.0.5CVE-2023-20578derived from NVD
epyc 73f3 firmwareNVD
Affected:< milanpi_1.0.0.5Fixed in:milanpi_1.0.0.5CVE-2023-20578derived from NVD
epyc 7401 firmwareNVD
Affected:< naplespi_1.0.0.kFixed in:naplespi_1.0.0.kCVE-2023-20578derived from NVD
epyc 7401p firmwareNVD
Affected:< naplespi_1.0.0.kFixed in:naplespi_1.0.0.kCVE-2023-20578derived from NVD
epyc 7402 firmwareNVD
Affected:< romepi_1.0.0.gFixed in:romepi_1.0.0.gCVE-2023-20578derived from NVD
epyc 7402p firmwareNVD
Affected:< romepi_1.0.0.gFixed in:romepi_1.0.0.gCVE-2023-20578derived from NVD
epyc 7413 firmwareNVD
Affected:< milanpi_1.0.0.5Fixed in:milanpi_1.0.0.5CVE-2023-20578derived from NVD
epyc 7443 firmwareNVD
Affected:< milanpi_1.0.0.5Fixed in:milanpi_1.0.0.5CVE-2023-20578derived from NVD
epyc 7443p firmwareNVD
Affected:< milanpi_1.0.0.5Fixed in:milanpi_1.0.0.5CVE-2023-20578derived from NVD
epyc 7451 firmwareNVD
Affected:< naplespi_1.0.0.kFixed in:naplespi_1.0.0.kCVE-2023-20578derived from NVD
epyc 7452 firmwareNVD
Affected:< romepi_1.0.0.gFixed in:romepi_1.0.0.gCVE-2023-20578derived from NVD
epyc 7453 firmwareNVD
Affected:< milanpi_1.0.0.5Fixed in:milanpi_1.0.0.5CVE-2023-20578derived from NVD
epyc 7473x firmwareNVD
Affected:< milanpi_1.0.0.5Fixed in:milanpi_1.0.0.5CVE-2023-20578derived from NVD
epyc 74f3 firmwareNVD
Affected:< milanpi_1.0.0.5Fixed in:milanpi_1.0.0.5CVE-2023-20578derived from NVD
epyc 7501 firmwareNVD
Affected:< naplespi_1.0.0.kFixed in:naplespi_1.0.0.kCVE-2023-20578derived from NVD
epyc 7502 firmwareNVD
Affected:< romepi_1.0.0.gFixed in:romepi_1.0.0.gCVE-2023-20578derived from NVD
epyc 7502p firmwareNVD
Affected:< romepi_1.0.0.gFixed in:romepi_1.0.0.gCVE-2023-20578derived from NVD
epyc 7513 firmwareNVD
Affected:< milanpi_1.0.0.5Fixed in:milanpi_1.0.0.5CVE-2023-20578derived from NVD
epyc 7532 firmwareNVD
Affected:< romepi_1.0.0.gFixed in:romepi_1.0.0.gCVE-2023-20578derived from NVD
epyc 7542 firmwareNVD
Affected:< romepi_1.0.0.gFixed in:romepi_1.0.0.gCVE-2023-20578derived from NVD
epyc 7543 firmwareNVD
Affected:< milanpi_1.0.0.5Fixed in:milanpi_1.0.0.5CVE-2023-20578derived from NVD
epyc 7543p firmwareNVD
Affected:< milanpi_1.0.0.5Fixed in:milanpi_1.0.0.5CVE-2023-20578derived from NVD
epyc 7551 firmwareNVD
Affected:< naplespi_1.0.0.kFixed in:naplespi_1.0.0.kCVE-2023-20578derived from NVD
epyc 7551p firmwareNVD
Affected:< naplespi_1.0.0.kFixed in:naplespi_1.0.0.kCVE-2023-20578derived from NVD
epyc 7552 firmwareNVD
Affected:< romepi_1.0.0.gFixed in:romepi_1.0.0.gCVE-2023-20578derived from NVD
epyc 7573x firmwareNVD
Affected:< milanpi_1.0.0.5Fixed in:milanpi_1.0.0.5CVE-2023-20578derived from NVD
epyc 75f3 firmwareNVD
Affected:< milanpi_1.0.0.5Fixed in:milanpi_1.0.0.5CVE-2023-20578derived from NVD
epyc 7601 firmwareNVD
Affected:< naplespi_1.0.0.kFixed in:naplespi_1.0.0.kCVE-2023-20578derived from NVD
epyc 7642 firmwareNVD
Affected:< romepi_1.0.0.gFixed in:romepi_1.0.0.gCVE-2023-20578derived from NVD
epyc 7643 firmwareNVD
Affected:< milanpi_1.0.0.5Fixed in:milanpi_1.0.0.5CVE-2023-20578derived from NVD
epyc 7643p firmwareNVD
Affected:< milanpi_1.0.0.5Fixed in:milanpi_1.0.0.5CVE-2023-20578derived from NVD
epyc 7662 firmwareNVD
Affected:< romepi_1.0.0.gFixed in:romepi_1.0.0.gCVE-2023-20578derived from NVD
epyc 7663 firmwareNVD
Affected:< milanpi_1.0.0.5Fixed in:milanpi_1.0.0.5CVE-2023-20578derived from NVD
epyc 7663p firmwareNVD
Affected:< milanpi_1.0.0.5Fixed in:milanpi_1.0.0.5CVE-2023-20578derived from NVD
epyc 7702 firmwareNVD
Affected:< romepi_1.0.0.gFixed in:romepi_1.0.0.gCVE-2023-20578derived from NVD
epyc 7702p firmwareNVD
Affected:< romepi_1.0.0.gFixed in:romepi_1.0.0.gCVE-2023-20578derived from NVD
epyc 7713 firmwareNVD
Affected:< milanpi_1.0.0.5Fixed in:milanpi_1.0.0.5CVE-2023-20578derived from NVD
epyc 7713p firmwareNVD
Affected:< milanpi_1.0.0.5Fixed in:milanpi_1.0.0.5CVE-2023-20578derived from NVD
epyc 7742 firmwareNVD
Affected:< romepi_1.0.0.gFixed in:romepi_1.0.0.gCVE-2023-20578derived from NVD
epyc 7763 firmwareNVD
Affected:< milanpi_1.0.0.5Fixed in:milanpi_1.0.0.5CVE-2023-20578derived from NVD
epyc 7773x firmwareNVD
Affected:< milanpi_1.0.0.5Fixed in:milanpi_1.0.0.5CVE-2023-20578derived from NVD
epyc 7f32 firmwareNVD
Affected:< romepi_1.0.0.gFixed in:romepi_1.0.0.gCVE-2023-20578derived from NVD
epyc 7f52 firmwareNVD
Affected:< romepi_1.0.0.gFixed in:romepi_1.0.0.gCVE-2023-20578derived from NVD
epyc 7f72 firmwareNVD
Affected:< romepi_1.0.0.gFixed in:romepi_1.0.0.gCVE-2023-20578derived from NVD
epyc 7h12 firmwareNVD
Affected:< romepi_1.0.0.gFixed in:romepi_1.0.0.gCVE-2023-20578derived from NVD
epyc 8024p firmwareNVD
Affected:< genoapi_1.0.0.2Fixed in:genoapi_1.0.0.2CVE-2023-20578derived from NVD
epyc 8024pn firmwareNVD
Affected:< genoapi_1.0.0.2Fixed in:genoapi_1.0.0.2CVE-2023-20578derived from NVD
epyc 8124p firmwareNVD
Affected:< genoapi_1.0.0.2Fixed in:genoapi_1.0.0.2CVE-2023-20578derived from NVD
epyc 8124pn firmwareNVD
Affected:< genoapi_1.0.0.2Fixed in:genoapi_1.0.0.2CVE-2023-20578derived from NVD
epyc 8224p firmwareNVD
Affected:< genoapi_1.0.0.2Fixed in:genoapi_1.0.0.2CVE-2023-20578derived from NVD
epyc 8224pn firmwareNVD
Affected:< genoapi_1.0.0.2Fixed in:genoapi_1.0.0.2CVE-2023-20578derived from NVD
epyc 8324p firmwareNVD
Affected:< genoapi_1.0.0.2Fixed in:genoapi_1.0.0.2CVE-2023-20578derived from NVD
epyc 8324pn firmwareNVD
Affected:< genoapi_1.0.0.2Fixed in:genoapi_1.0.0.2CVE-2023-20578derived from NVD
epyc 8434p firmwareNVD
Affected:< genoapi_1.0.0.2Fixed in:genoapi_1.0.0.2CVE-2023-20578derived from NVD
epyc 8434pn firmwareNVD
Affected:< genoapi_1.0.0.2Fixed in:genoapi_1.0.0.2CVE-2023-20578derived from NVD
epyc 8534p firmwareNVD
Affected:< genoapi_1.0.0.2Fixed in:genoapi_1.0.0.2CVE-2023-20578derived from NVD
epyc 8534pn firmwareNVD
Affected:< genoapi_1.0.0.2Fixed in:genoapi_1.0.0.2CVE-2023-20578derived from NVD
epyc 9124 firmwareNVD
Affected:< genoapi_1.0.0.2Fixed in:genoapi_1.0.0.2CVE-2023-20578derived from NVD
epyc 9174f firmwareNVD
Affected:< genoapi_1.0.0.2Fixed in:genoapi_1.0.0.2CVE-2023-20578derived from NVD
epyc 9184x firmwareNVD
Affected:< genoapi_1.0.0.2Fixed in:genoapi_1.0.0.2CVE-2023-20578derived from NVD
epyc 9224 firmwareNVD
Affected:< genoapi_1.0.0.2Fixed in:genoapi_1.0.0.2CVE-2023-20578derived from NVD
epyc 9254 firmwareNVD
Affected:< genoapi_1.0.0.2Fixed in:genoapi_1.0.0.2CVE-2023-20578derived from NVD
epyc 9274f firmwareNVD
Affected:< genoapi_1.0.0.2Fixed in:genoapi_1.0.0.2CVE-2023-20578derived from NVD
epyc 9334 firmwareNVD
Affected:< genoapi_1.0.0.2Fixed in:genoapi_1.0.0.2CVE-2023-20578derived from NVD
epyc 9354 firmwareNVD
Affected:< genoapi_1.0.0.2Fixed in:genoapi_1.0.0.2CVE-2023-20578derived from NVD
epyc 9354p firmwareNVD
Affected:< genoapi_1.0.0.2Fixed in:genoapi_1.0.0.2CVE-2023-20578derived from NVD
epyc 9374f firmwareNVD
Affected:< genoapi_1.0.0.2Fixed in:genoapi_1.0.0.2CVE-2023-20578derived from NVD
epyc 9384x firmwareNVD
Affected:< genoapi_1.0.0.2Fixed in:genoapi_1.0.0.2CVE-2023-20578derived from NVD
epyc 9454 firmwareNVD
Affected:< genoapi_1.0.0.2Fixed in:genoapi_1.0.0.2CVE-2023-20578derived from NVD
epyc 9454p firmwareNVD
Affected:< genoapi_1.0.0.2Fixed in:genoapi_1.0.0.2CVE-2023-20578derived from NVD
epyc 9474f firmwareNVD
Affected:< genoapi_1.0.0.2Fixed in:genoapi_1.0.0.2CVE-2023-20578derived from NVD
epyc 9534 firmwareNVD
Affected:< genoapi_1.0.0.2Fixed in:genoapi_1.0.0.2CVE-2023-20578derived from NVD
epyc 9554 firmwareNVD
Affected:< genoapi_1.0.0.2Fixed in:genoapi_1.0.0.2CVE-2023-20578derived from NVD
epyc 9554p firmwareNVD
Affected:< genoapi_1.0.0.2Fixed in:genoapi_1.0.0.2CVE-2023-20578derived from NVD
epyc 9634 firmwareNVD
Affected:< genoapi_1.0.0.2Fixed in:genoapi_1.0.0.2CVE-2023-20578derived from NVD
epyc 9654 firmwareNVD
Affected:< genoapi_1.0.0.2Fixed in:genoapi_1.0.0.2CVE-2023-20578derived from NVD
epyc 9654p firmwareNVD
Affected:< genoapi_1.0.0.2Fixed in:genoapi_1.0.0.2CVE-2023-20578derived from NVD
epyc 9684x firmwareNVD
Affected:< genoapi_1.0.0.2Fixed in:genoapi_1.0.0.2CVE-2023-20578derived from NVD
epyc 9734 firmwareNVD
Affected:< genoapi_1.0.0.2Fixed in:genoapi_1.0.0.2CVE-2023-20578derived from NVD
epyc 9754 firmwareNVD
Affected:< genoapi_1.0.0.2Fixed in:genoapi_1.0.0.2CVE-2023-20578derived from NVD
epyc 9754s firmwareNVD
Affected:< genoapi_1.0.0.2Fixed in:genoapi_1.0.0.2CVE-2023-20578derived from NVD

Remediation is compiled from vendor and distribution security advisories. Always confirm against the linked source for your exact version and platform.

CVSS v3 Vector

Exploitability

Attack VectorLocal
Attack ComplexityHigh
Privileges RequiredHigh
User InteractionNone
ScopeChanged

Impact

ConfidentialityHigh
IntegrityHigh
AvailabilityHigh

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Exploit Intelligence

0.12%probability of exploitation in 30 days
2ndpercentile

Low risk: more likely to be exploited than 2% of all known CVEs.

References

Vendor Advisory1

Related Vulnerabilities

Other CWE-367 (TOCTOU Race Condition) vulnerabilities, ordered by exploit likelihood. View all

CVESeverityCVSSEPSSExploitedFix
CVE-2022-36980High8.183%-Fix
CVE-2024-30088High7.068%KEV + RansomFix
CVE-2004-0594Medium5.155%-Fix
CVE-2024-50379Critical9.844%-Fix
CVE-2023-38146High8.839%-Fix
CVE-2024-0132Critical9.037%-Fix
Embed a live status badge for CVE-2023-20578
CVE-2023-20578 severity badge

Markdown

[![CVE-2023-20578](https://tridentstack.com/cve/badge/CVE-2023-20578.svg)](https://tridentstack.com/cve/CVE-2023-20578)

HTML

<a href="https://tridentstack.com/cve/CVE-2023-20578"><img src="https://tridentstack.com/cve/badge/CVE-2023-20578.svg" alt="CVE-2023-20578"></a>

Find and fix vulnerabilities across your fleet

TridentStack Control continuously scans your Windows, macOS, and Linux fleet for known vulnerabilities, prioritizes them by severity and active exploitation, and patches them automatically.

Start free

This product uses NVD data but is not endorsed or certified by the NVD. EPSS scores courtesy of FIRST.org (https://www.first.org/epss). Source: CISA KEV Catalog. Data as of 2025-03-18.