TOCTOU in the ASP Bootloader may allow an attacker with physical access to tamper with SPI ROM records after memory content verification, potentially leading to loss of confidentiality or a denial of service.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4654-1 advisory.

    Update AMD ucode to 20231030 (bsc#1215831):

    - CVE-2022-23820: Failure to validate the AMD SMM communication buffer may allow an attacker to corrupt     the SMRAM potentially leading to arbitrary code execution.
    - CVE-2021-46774: Insufficient input validation in ABL may enable a privileged attacker to perform     arbitrary DRAM writes, potentially resulting in code execution and privilege escalation.
    - CVE-2023-20533: Insufficient DRAM address validation in System Management Unit (SMU) may allow an     attacker using DMA to read/write from/to invalid DRAM address potentially resulting in denial-of-service.
    0 CVE-2023-20519: A Use-After-Free vulnerability in the management of an SNP guest context page may allow     a malicious hypervisor to masquerade as the guest's migration agent resulting in a potential loss of guest     integrity.
    - CVE-2023-20566: Improper address validation in ASP with SNP enabled may potentially allow an attacker to     compromise guest memory integrity.
    - CVE-2023-20521: TOCTOU in the ASP Bootloader may allow an attacker with physical access to tamper with     SPI ROM records after memory content verification, potentially leading to loss of confidentiality or a     denial of service.
    - CVE-2021-46766: Improper clearing of sensitive data in the ASP Bootloader may expose secret keys to a     privileged attacker accessing ASP SRAM, potentially leading to a loss of confidentiality.
    - CVE-2022-23830: SMM configuration may not be immutable, as intended, when SNP is enabled resulting in a     potential limited loss of guest memory integrity.
    - CVE-2023-20526: Insufficient input validation in the ASP Bootloader may enable a privileged attacker     with physical access to expose the contents of ASP memory potentially leading to a loss of     confidentiality.
    - CVE-2021-26345: Failure to validate the value in APCB may allow an attacker with physical access to     tamper with the APCB token to force an out-of-bounds memory read potentially resulting in a denial of     service.
    - CVE-2023-20592: Issue with INVD instruction aka CacheWarpAttack (bsc#1215823).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4665-1 advisory.

    Update AMD ucode to 20231030 (bsc#1215831):

    - CVE-2022-23820: Failure to validate the AMD SMM communication buffer may allow an attacker to corrupt     the SMRAM potentially leading to arbitrary code execution.
    - CVE-2021-46774: Insufficient input validation in ABL may enable a privileged attacker to perform     arbitrary DRAM writes, potentially resulting in code execution and privilege escalation.
    - CVE-2023-20533: Insufficient DRAM address validation in System Management Unit (SMU) may allow an     attacker using DMA to read/write from/to invalid DRAM address potentially resulting in denial-of-service.
    0 CVE-2023-20519: A Use-After-Free vulnerability in the management of an SNP guest context page may allow     a malicious hypervisor to masquerade as the guest's migration agent resulting in a potential loss of guest     integrity.
    - CVE-2023-20566: Improper address validation in ASP with SNP enabled may potentially allow an attacker to     compromise guest memory integrity.
    - CVE-2023-20521: TOCTOU in the ASP Bootloader may allow an attacker with physical access to tamper with     SPI ROM records after memory content verification, potentially leading to loss of confidentiality or a     denial of service.
    - CVE-2021-46766: Improper clearing of sensitive data in the ASP Bootloader may expose secret keys to a     privileged attacker accessing ASP SRAM, potentially leading to a loss of confidentiality.
    - CVE-2022-23830: SMM configuration may not be immutable, as intended, when SNP is enabled resulting in a     potential limited loss of guest memory integrity.
    - CVE-2023-20526: Insufficient input validation in the ASP Bootloader may enable a privileged attacker     with physical access to expose the contents of ASP memory potentially leading to a loss of     confidentiality.
    - CVE-2021-26345: Failure to validate the value in APCB may allow an attacker with physical access to     tamper with the APCB token to force an out-of-bounds memory read potentially resulting in a denial of     service.
    - CVE-2023-20592: Issue with INVD instruction aka CacheWarpAttack (bsc#1215823).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
186648	SUSE SLES15 Security Update : kernel-firmware (SUSE-SU-2023:4654-1)	Nessus	SuSE Local Security Checks	Local	critical
186646	SUSE SLES15 Security Update : kernel-firmware (SUSE-SU-2023:4665-1)	Nessus	SuSE Local Security Checks	Local	critical

Detections

Analytics

CVE-2023-20521

medium

Tenable Plugins

critical

critical