Improper validation in a model specific register (MSR) could allow a malicious program with ring0 access to modify SMM configuration while SMI lock is enabled, potentially leading to arbitrary code execution.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-3cd42e9e29 advisory.

    Update to upstream 20240909:

    * i915: Update MTL DMC v2.23
    * cirrus: cs35l56: Add firmware for Cirrus CS35L54 for some HP laptops
    * amdgpu: Revert sienna cichlid dmcub firmware update
    * iwlwifi: add Bz FW for core89-58 release
    * rtl_nic: add firmware rtl8126a-3
    * update  MT7921 WiFi/bluetooth device firmware
    * amdgpu: update DMCUB to v0.0.232.0 for DCN314 and DCN351
    * amdgpu: DMCUB updates forvarious AMDGPU ASICs
    * rtw89: 8922a: add fw format-1 v0.35.41.0
    * update  MT7925 WiFi/bluetooth device firmware
    * rtl_bt: Add firmware and config files for RTL8922A
    * rtl_bt: Add firmware file for the the RTL8723CS Bluetooth part
    * rtl_bt: de-dupe identical config.bin files
    * rename rtl8723bs_config-OBDA8723.bin -> rtl_bt/rtl8723bs_config.bin
    * Update AMD SEV firmware
    * update firmware for MT7996
    * Revert i915: Update MTL DMC v2.22
    * ath12k: WCN7850 hw2.0: update board-2.bin
    * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.41
    * ath11k: WCN6855 hw2.0: update board-2.bin
    * ath11k: QCA2066 hw2.1: add to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.3
    * ath11k: QCA2066 hw2.1: add board-2.bin
    * ath11k: IPQ5018 hw1.0: update to WLAN.HK.2.6.0.1-01291-QCAHKSWPL_SILICONZ-1
    * qcom: vpu: add video firmware for sa8775p
    * amdgpu: DMCUB updates for various AMDGPU ASICs

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 host has a package installed that is affected by a vulnerability as referenced in the USN-7077-1 advisory.

    Enrique Nissim and Krzysztof Okupski discovered that some AMD processors did not properly restrict access     to the System Management Mode (SMM) configuration when the SMM Lock was enabled. A privileged local     attacker could possibly use this issue to further escalate their privileges and execute arbitrary code     within the processor's firmware layer.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:7481 advisory.

    The linux-firmware packages contain all of the firmware files that are required by various devices to     operate.

    Security Fix(es):

    * kernel: hw:amd:IOMMU improperly handles certain special address leading to a loss of guest integrity     (CVE-2023-20584)

    * kernel: hw: amd:Incomplete system memory cleanup in SEV firmware corrupt guest private memory     (CVE-2023-31356)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-3dbf10c949 advisory.

    Update to upstream 20240909:

    * i915: Update MTL DMC v2.23
    * cirrus: cs35l56: Add firmware for Cirrus CS35L54 for some HP laptops
    * amdgpu: Revert sienna cichlid dmcub firmware update
    * iwlwifi: add Bz FW for core89-58 release
    * rtl_nic: add firmware rtl8126a-3
    * update  MT7921 WiFi/bluetooth device firmware
    * amdgpu: update DMCUB to v0.0.232.0 for DCN314 and DCN351
    * amdgpu: DMCUB updates forvarious AMDGPU ASICs
    * rtw89: 8922a: add fw format-1 v0.35.41.0
    * update  MT7925 WiFi/bluetooth device firmware
    * rtl_bt: Add firmware and config files for RTL8922A
    * rtl_bt: Add firmware file for the the RTL8723CS Bluetooth part
    * rtl_bt: de-dupe identical config.bin files
    * rename rtl8723bs_config-OBDA8723.bin -> rtl_bt/rtl8723bs_config.bin
    * Update AMD SEV firmware
    * update firmware for MT7996
    * Revert i915: Update MTL DMC v2.22
    * ath12k: WCN7850 hw2.0: update board-2.bin
    * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.41
    * ath11k: WCN6855 hw2.0: update board-2.bin
    * ath11k: QCA2066 hw2.1: add to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.3
    * ath11k: QCA2066 hw2.1: add board-2.bin
    * ath11k: IPQ5018 hw1.0: update to WLAN.HK.2.6.0.1-01291-QCAHKSWPL_SILICONZ-1
    * qcom: vpu: add video firmware for sa8775p
    * amdgpu: DMCUB updates for various AMDGPU ASICs

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-f32e633786 advisory.

    Update to upstream 20240909:

    * i915: Update MTL DMC v2.23
    * cirrus: cs35l56: Add firmware for Cirrus CS35L54 for some HP laptops
    * amdgpu: Revert sienna cichlid dmcub firmware update
    * iwlwifi: add Bz FW for core89-58 release
    * rtl_nic: add firmware rtl8126a-3
    * update  MT7921 WiFi/bluetooth device firmware
    * amdgpu: update DMCUB to v0.0.232.0 for DCN314 and DCN351
    * amdgpu: DMCUB updates forvarious AMDGPU ASICs
    * rtw89: 8922a: add fw format-1 v0.35.41.0
    * update  MT7925 WiFi/bluetooth device firmware
    * rtl_bt: Add firmware and config files for RTL8922A
    * rtl_bt: Add firmware file for the the RTL8723CS Bluetooth part
    * rtl_bt: de-dupe identical config.bin files
    * rename rtl8723bs_config-OBDA8723.bin -> rtl_bt/rtl8723bs_config.bin
    * Update AMD SEV firmware
    * update firmware for MT7996
    * Revert i915: Update MTL DMC v2.22
    * ath12k: WCN7850 hw2.0: update board-2.bin
    * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.41
    * ath11k: WCN6855 hw2.0: update board-2.bin
    * ath11k: QCA2066 hw2.1: add to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.3
    * ath11k: QCA2066 hw2.1: add board-2.bin
    * ath11k: IPQ5018 hw1.0: update to WLAN.HK.2.6.0.1-01291-QCAHKSWPL_SILICONZ-1
    * qcom: vpu: add video firmware for sa8775p
    * amdgpu: DMCUB updates for various AMDGPU ASICs

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:3081-1 advisory.

    - CVE-2023-31315: Fixed validation in a model specific register (MSR) that lead to modification of SMM     configuration by malicious program with ring0 access (bsc#1229069)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:5980 advisory.

    The linux-firmware packages contain all of the firmware files that are required by various devices to     operate.

    Security Fix(es):

    * hw: amd: SMM Lock Bypass (AMD-SB-7014,CVE-2023-31315)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:5982 advisory.

    The linux-firmware packages contain all of the firmware files that are required by various devices to     operate.

    Security Fix(es):

    * hw: amd: SMM Lock Bypass (AMD-SB-7014,CVE-2023-31315)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:5978 advisory.

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of linux-firmware installed on the remote host is prior to 20200421-82.git78c0348. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2626 advisory.

    Improper validation in a model specific register (MSR) could allow a malicious program with ring0 access     to modify SMM configuration while SMI lock is enabled, potentially leading to arbitrary code execution.
    (CVE-2023-31315)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:2980-1 advisory.

    CVE-2023-31315: Fixed validation in a model specific register (MSR) that lead to modification of SMM     configuration by malicious program with ring0 access (bsc#1229069)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-706 advisory.

    Improper validation in a model specific register (MSR) could allow a malicious program with ring0 access     to modify SMM configuration while SMI lock is enabled, potentially leading to arbitrary code execution.
    (CVE-2023-31315)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:2943-1 advisory.

    - CVE-2023-31315: Fixed validation in a model specific register (MSR) that lead to modification of SMM     configuration by malicious program with ring0 access (bsc#1229069)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:2944-1 advisory.

    - CVE-2023-31315: Fixed validation in a model specific register (MSR) that lead to modification of SMM     configuration by malicious program with ring0 access (bsc#1229069)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:2911-1 advisory.

    - CVE-2023-31315: Fixed validation in a model specific register (MSR) that lead to modification of SMM     configuration by malicious program with ring0 access (bsc#1229069)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 7d631146-5769-11ef-b618-1c697a616631 advisory.

    AMD reports:

               Researchers from IOActive have reported that it may be possible for                an attacker with ring 0 access to modify the configuration of System                Management Mode (SMM) even when SMM Lock is enabled.  Improper                validation in a model specific register (MSR) could allow a malicious                program with ring0 access to modify SMM configuration while SMI lock                is enabled, potentially leading to arbitrary code execution.


Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-12579 advisory.

    [20240715-999.34.git4c8fb21e.el7]
    - Rebase to latest upstream [Orabug: 36826157]

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-12580 advisory.

    [20240715-999.34.git4c8fb21e.el8]
    - Rebase to latest upstream [Orabug: 36826157]

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-12578 advisory.

    [20240715-999.34.git4c8fb21e.el9]
    - Rebase to latest upstream [Orabug: 36826157]

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
210969	Fedora 41 : linux-firmware (2024-3cd42e9e29)	Nessus	Fedora Local Security Checks	medium
209342	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 : AMD Microcode vulnerability (USN-7077-1)	Nessus	Ubuntu Local Security Checks	medium
208011	RHEL 8 : linux-firmware (RHSA-2024:7481)	Nessus	Red Hat Local Security Checks	medium
207326	Fedora 39 : linux-firmware (2024-3dbf10c949)	Nessus	Fedora Local Security Checks	medium
206948	Fedora 40 : linux-firmware (2024-f32e633786)	Nessus	Fedora Local Security Checks	medium
206442	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : kernel-firmware (SUSE-SU-2024:3081-1)	Nessus	SuSE Local Security Checks	medium
206290	RHEL 9 : linux-firmware (RHSA-2024:5980)	Nessus	Red Hat Local Security Checks	medium
206289	RHEL 7 : linux-firmware (RHSA-2024:5982)	Nessus	Red Hat Local Security Checks	medium
206288	RHEL 7 : linux-firmware (RHSA-2024:5978)	Nessus	Red Hat Local Security Checks	medium
206020	Amazon Linux 2 : linux-firmware (ALAS-2024-2626)	Nessus	Amazon Linux Local Security Checks	medium
205994	SUSE SLES15 Security Update : kernel-firmware (SUSE-SU-2024:2980-1)	Nessus	SuSE Local Security Checks	medium
205808	Amazon Linux 2023 : iwl100-firmware, iwl105-firmware, iwl135-firmware (ALAS2023-2024-706)	Nessus	Amazon Linux Local Security Checks	medium
205748	SUSE SLES15 Security Update : kernel-firmware (SUSE-SU-2024:2943-1)	Nessus	SuSE Local Security Checks	medium
205738	SUSE SLES15 Security Update : kernel-firmware (SUSE-SU-2024:2944-1)	Nessus	SuSE Local Security Checks	medium
205568	SUSE SLES12 Security Update : kernel-firmware (SUSE-SU-2024:2911-1)	Nessus	SuSE Local Security Checks	medium
205355	FreeBSD : AMD CPUs -- Guest Memory Vulnerabilities (7d631146-5769-11ef-b618-1c697a616631)	Nessus	FreeBSD Local Security Checks	medium
205333	Oracle Linux 7 : linux-firmware (ELSA-2024-12579)	Nessus	Oracle Linux Local Security Checks	medium
205319	Oracle Linux 8 : linux-firmware (ELSA-2024-12580)	Nessus	Oracle Linux Local Security Checks	medium
205299	Oracle Linux 9 : linux-firmware (ELSA-2024-12578)	Nessus	Oracle Linux Local Security Checks	medium

Detections

Analytics

CVE-2023-31315

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium