# AMD processor vulnerabilities

**URL:** <https://community.frame.work/t/amd-processor-vulnerabilities/45423>\
**Category:** Community Support\
**Tags:** hardware\
**Created:** [February 16, 2024, 10:20pm UTC](https://community.frame.work/t/amd-processor-vulnerabilities/45423 "2024-02-16T22:20:02Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sean\_Whalen](https://sea1.discourse-cdn.com/flex001/user_avatar/community.frame.work/sean_whalen/32/15402_2.png) [@Sean\_Whalen](https://community.frame.work/u/Sean_Whalen)\
**Post date:** [February 16, 2024, 10:20pm UTC](https://community.frame.work/t/amd-processor-vulnerabilities/45423/1 "2024-02-16T22:20:02Z")

</div>

I reached out to Framework support February 15 to ask about their patching plans for the processor vulnerabilities by AMD on February 13. Even with all the chaos of the Framework Laptop 16 launch, Framework support gave me a vary transparent and detailed response the next day. Impressive!

> Hello Sean,
> 
> Thank you for reaching out and for your patience, this case was escalated for review. Our Framework Laptops on the AMD Ryzen™ 7040 Series platform are currently on version PI 1.0.0.2.
> 
> Our sustaining BIOS team is working on forthcoming BIOS updates that include the update to PI 1.1.0.2 which mitigates all listed CVEs for the platform. We are working with our BIOS Vendor to test this release internally and will release a community BIOS update as soon as this internal quality assurance is complete.
> 
> To be entirely transparent we had prepared this update previously, and during internal testing we identified issues with the update which needed addressing before a customer facing release, and the subsequent update has been delayed slightly by our Vendor’s closure during the Lunar New Year Holiday in Taiwan. This update is currently our sustaining team’s highest priority so we will endeavor to provide an update in our community very soon.  
> Regards,  
> Framework Support

Here are the vulnerability details for security nerds like me:

Bulletin ID: [AMD-SB-7009](https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7009.html)

AMD Ryzen™ 7040 Series Processors with Radeon™ Graphics

CVE-2023-20576  
Severity: High  
Insufficient Verification of Data Authenticity in AGESA™ may allow an attacker to update SPI ROM data potentially resulting in denial of service or privilege escalation.

CVE-2023-20577  
Severity: High  
A heap overflow in SMM module may allow an attacker with access to a second vulnerability that enables writing to SPI flash, potentially resulting in arbitrary code execution.

CVE-2023-20579  
Severity: High  
Improper Access Control in the AMD SPI protection feature may allow a user with Ring0 (kernel mode) privileged access to bypass protections potentially resulting in loss of integrity and availability.

CVE-2023-20587

Not affected

Minimum version to mitigate all listed CVEs: PhoenixPI-FP8-FP7 1.1.0.0 (2023-10-06)

---

<div class="post-metadata">

**Author:** ![Aurelien\_D](https://sea1.discourse-cdn.com/flex001/user_avatar/community.frame.work/aurelien_d/32/16071_2.png) [@Aurelien\_D](https://community.frame.work/u/Aurelien_D)\
**Post date:** [February 17, 2024, 8:33am UTC](https://community.frame.work/t/amd-processor-vulnerabilities/45423/2 "2024-02-17T08:33:49Z")

</div>

Amazing response from Framework that make me more confident about my future new toy : FW16"

Keep up the good work Framework ❤ !