CVE-2023-31325
Raw vector
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-31325 is a high-severity SoC (CWE-1189) vulnerability in Amd (inferred from references). Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data Obfuscation (T1001); ranked at the 3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SC-32 (System Partitioning) and SC-4 (Information in Shared System Resources) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-35636
Vulnerability Data
Improper isolation of shared resources on System-on-a-chip (SOC) could a privileged attacker to tamper with the contents of the PSP reserved DRAM region potentially resulting in loss of confidentiality and integrity.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SC-4 explicitly prevents unauthorized information transfer via shared system resources, addressing the core SoC isolation failure.
SC-49 mandates hardware-enforced separation between security domains, directly countering improper SoC resource isolation.
SC-32 requires partitioning the system into separate domains, structurally preventing shared-resource leakage on an SoC.
SC-50 requires software-enforced separation mechanisms that would prevent the described SoC shared-resource weakness.
SC-3 requires isolation of security functions from non-security ones, directly preventing improper sharing of SoC resources between trusted and untrusted agents.
SC-39 enforces separate execution domains for processes, stopping unintended sharing of SoC resources between trust levels.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Contractual requirements on suppliers can mandate proper SoC resource isolation.
Hardware integrity/authenticity checks before acquisition can verify isolation features.
Supplier assessments can evaluate SoC isolation capabilities prior to purchase.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
A.8.22 segregates network domains and controls inter-domain traffic at perimeters/gateways; it has no bearing on SoC-level isolation of on-chip shared resources between trusted/untrusted agents, so the hardware design flaw is never removed.
Secure system architecture and engineering principles directly require hardware-level isolation of shared SoC resources.
Security testing can detect SoC isolation issues but does not prevent the weakness from existing in the design.