dbcve.org
Genoa FirmwareOperating system · Amd

CVE-2022-29277

HIGH · 8.8 CVSS v3.1 Published 2022-11-15
Fix available
A fix is available. Upgrade to 05.36.10.0017 / 05.36.26.0016 or later.
See remediation →
90/100
Remediation priority · Urgent
Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
Incorrect pointer checks within the the FwBlockServiceSmm driver can allow arbitrary RAM modifications During review of the FwBlockServiceSmm driver, certain instances of SpiAccessLib could be tricked into writing 0xff to arbitrary system and SMRAM addresses. Fixed in: INTEL Purley-R: 05.21.51.0048 Whitley: 05.42.23.0066 Cedar Island: 05.42.11.0021 Eagle Stream: 05.44.25.0052 Greenlow/Greenlow-R(skylake/kabylake): Trunk Mehlow/Mehlow-R (CoffeeLake-S): Trunk Tatlow (RKL-S): Trunk Denverton: 05.10.12.0042 Snow Ridge: Trunk Graneville DE: 05.05.15.0038 Grangeville DE NS: 05.27.26.0023 Bakerville: 05.21.51.0026 Idaville: 05.44.27.0030 Whiskey Lake: Trunk Comet Lake-S: Trunk Tiger Lake H/UP3: 05.43.12.0052 Alder Lake: 05.44.23.0047 Gemini Lake: Not Affected Apollo Lake: Not Affected Elkhart Lake: 05.44.30.0018 AMD ROME: trunk MILAN: 05.36.10.0017 GENOA: 05.52.25.0006 Snowy Owl: Trunk R1000: 05.32.50.0018 R2000: 05.44.30.0005 V2000: Trunk V3000: 05.44.30.0007 Ryzen 5000: 05.44.30.0004 Embedded ROME: Trunk Embedded MILAN: Trunk Hygon Hygon #1/#2: 05.36.26.0016 Hygon #3: 05.44.26.0007 https://www.insyde.com/security-pledge/SA-2022060

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

Incorrect pointer checks in the FwBlockServiceSmm driver's SpiAccessLib can be exploited to write 0xff to arbitrary system and SMRAM addresses, enabling an attacker with local code execution to escalate privileges to System Management Mode (SMM) and perform arbitrary memory modifications.

MitigationApply vendor-provided firmware updates from Intel/AMD for the affected platform generations listed in the security advisory; no workarounds available.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
Genoa FirmwareOperating system
Affected:< 05.52.25.0006
Hygon 1 FirmwareOperating system
Affected:< 05.36.26.0016
Hygon 2 FirmwareOperating system
Affected:< 05.36.26.0016
Hygon 3 FirmwareOperating system
Affected:< 05.44.26.0007
Milan FirmwareOperating system
Affected:< 05.36.10.0017< 05.36.26.0016
Rome FirmwareOperating system
Affected:< 05.36.10.0017< 05.36.26.0016
Ryzen 5300g FirmwareOperating system
Affected:< 05.44.30.0004
Ryzen 5300ge FirmwareOperating system
Affected:< 05.44.30.0004

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify the AMD platform family
    Determine the specific AMD processor generation (Genoa, Hygon 1/2/3, Milan, Rome, or Ryzen 5300g/5300ge) using system information tools such as 'lscpu', 'dmidecode', or vendor management interfaces.
    Affected if The system uses any of the AMD processor families listed in the affected products.
  2. Check the installed firmware version
    Retrieve the current BIOS or system firmware version using the appropriate method for your platform: 'dmidecode -s bios-version' on Linux, 'wmic bios get smbiosbiosversion' on Windows, or consult the UEFI/BIOS setup screen during boot. For server platforms, use vendor-specific tools such as AMD's or OEM's firmware update utilities.
    Affected if The installed firmware version cannot be determined or is below the thresholds listed for your specific platform.
  3. Compare against affected version ranges
    Cross-reference the installed firmware version number with the vulnerable version thresholds: Genoa < 05.52.25.0006, Hygon 1/2 < 05.36.26.0016, Hygon 3 < 05.44.26.0007, Milan and Rome < 05.36.10.0017 or < 05.36.26.0016, Ryzen 5300g/5300ge < 05.44.30.0004.
    Affected if The installed firmware version is lower than the specified version for your processor family.
  4. Verify local code execution threat model
    Assess whether the system is potentially subject to local code execution attacks, as this vulnerability requires an attacker to already have code execution capability to trigger the SMM privilege escalation.
    Affected if Local code execution is a plausible attack vector on this system (e.g., multi-tenant environment, shared hosting, or untrusted code execution).

A system is affected if it runs an AMD processor from the listed families with firmware version below the specified threshold, and an attacker could potentially achieve local code execution to trigger the SMM privilege escalation.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Upgrade available Upgrade to 05.36.10.0017 / 05.36.26.0016 / 05.44.26.0007 or later
Fixed in 05.36.10.001705.36.26.001605.44.26.0007
Interim mitigation

Apply vendor-provided firmware updates from Intel/AMD for the affected platform generations listed in the security advisory; no workarounds available.

Recommended fix High confidence

Firmware upgrade to the version specified in the security advisory for each platform (e.g., Milan: 05.36.10.0017, Genoa: 05.52.25.0006, Ryzen 5000: 05.44.30.0004)

  1. 1. Identify the exact model and current firmware version of the affected system (e.g., AMD Ryzen 5300G, AMD Rome, AMD Milan, Hygon, etc.)
  2. 2. Download the appropriate firmware update from the system manufacturer (OEM) or Insyde based on the platform
  3. 3. Apply the firmware update to the specific version: For AMD Ryzen 5300G/5300GE: upgrade to >= 05.44.30.0004 | For AMD Milan: upgrade to >= 05.36.10.0017 | For AMD Rome: upgrade to >= 05.36.10.0017 | For AMD Genoa: upgrade to >= 05.52.25.0006 | For Hygon #1/#2: upgrade to >= 05.36.26.0016 | For Hygon #3: upgrade to >= 05.44.26.0007 | For AMD R1000: upgrade to >= 05.32.50.0018 | For AMD R2000: upg
  4. 4. Verify the firmware version has been successfully applied after the update
Caveat Firmware updates carry inherent risk; ensure stable power during the update process and follow OEM-specific update procedures

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Genoa Firmware Scoped from the published advisory
  • Consultation4.0 h
  • Implementation2.0 h
  • Testing8.0 h
  • Review / QA4.0 h
18.0 hours of engineering $3,080
Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $4,928.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2022-29277 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2022-29277 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data