2nd Gen Amd Epyc (Amd) - vulnerabilities (CVEs)
19 CVEs, 0 in the last 30 days, 3 known versions, newest CVE from 2023-05-09. Vendor: Amd.
CVEs of 2nd Gen Amd Epyc
- CVE-2021-46762 - CVSS 9.1 (critical), 2023-05-09: Insufficient input validation in the SMU may allow an attacker to corrupt SMU SRAM potentially leading to a loss of integrity or denial of service.
- CVE-2021-46769 - CVSS 8.8 (high), 2023-05-09: Insufficient syscall input validation in the ASP Bootloader may allow a privileged attacker to execute arbitrary DMA copies, which can lead to code execution.
- CVE-2023-20524 - CVSS 7.5 (high), 2023-05-09: An attacker with a compromised ASP could possibly send malformed commands to an ASP on another CPU, resulting in an out of bounds write, potentially leading…
- CVE-2021-46764 - CVSS 7.5 (high), 2023-05-09: Improper validation of DRAM addresses in SMU may allow an attacker to overwrite sensitive memory locations within the ASP potentially resulting in a denial of…
- CVE-2023-20520 - CVSS 9.8 (critical), 2023-05-09: Improper access control settings in ASP Bootloader may allow an attacker to corrupt the return address causing a stack-based buffer overrun potentially…
- CVE-2021-46763 - CVSS 7.5 (high), 2023-05-09: Insufficient input validation in the SMU may enable a privileged attacker to write beyond the intended bounds of a shared memory buffer potentially leading to…
- CVE-2021-46775 - CVSS 6.8 (medium), 2023-05-09: Improper input validation in ABL may enable an attacker with physical access, to perform arbitrary memory overwrites, potentially leading to a loss of…
- CVE-2021-26379 - CVSS 9.8 (critical), 2023-05-09: Insufficient input validation of mailbox data in the SMU may allow an attacker to coerce the SMU to corrupt SMRAM, potentially leading to a loss of integrity…
- CVE-2021-26370 - CVSS 7.1 (high), 2022-05-10: Improper validation of destination address in SVC_LOAD_FW_IMAGE_BY_INSTANCE and SVC_LOAD_BINARY_BY_ATTRIB in a malicious UApp or ABL may allow an attacker to…
- CVE-2021-26408 - CVSS 7.1 (high), 2022-05-10: Insufficient validation of elliptic curve points in SEV-legacy firmware may compromise SEV-legacy guest migration potentially resulting in loss of guest's…
- CVE-2021-26331 - CVSS 7.8 (high), 2021-11-16: AMD System Management Unit (SMU) contains a potential issue where a malicious user may be able to manipulate mailbox entries leading to arbitrary code…
- CVE-2021-26330 - CVSS 5.5 (medium), 2021-11-16: AMD System Management Unit (SMU) may experience a heap-based overflow which may result in a loss of resources.
- CVE-2020-12954 - CVSS 5.5 (medium), 2021-11-16: A side effect of an integrated chipset option may be able to be used by an attacker to bypass SPI ROM protections, allowing unauthorized SPI ROM modification.
- CVE-2021-26321 - CVSS 5.5 (medium), 2021-11-16: Insufficient ID command validation in the SEV Firmware may allow a local authenticated attacker to perform a denial of service of the PSP.
- CVE-2021-26320 - CVSS 5.5 (medium), 2021-11-16: Insufficient validation of the AMD SEV Signing Key (ASK) in the SEND_START command in the SEV Firmware may allow a local authenticated attacker to perform a…
- CVE-2020-12961 - CVSS 7.8 (high), 2021-11-16: A potential vulnerability exists in AMD Platform Security Processor (PSP) that may allow an attacker to zero any privileged register on the System Management…
- CVE-2021-26338 - CVSS 7.5 (high), 2021-11-16: Improper access controls in System Management Unit (SMU) may allow for an attacker to override performance control tables located in DRAM resulting in a…
- CVE-2021-26329 - CVSS 5.5 (medium), 2021-11-16: AMD System Management Unit (SMU) may experience an integer overflow when an invalid length is provided which may result in a potential loss of resources.
- CVE-2021-26322 - CVSS 7.5 (high), 2021-11-16: Persistent platform private key may not be protected with a random IV leading to a potential “two time pad attack”.
