3rd Gen Epyc (Amd) - vulnerabilities (CVEs)

26 CVEs, 0 in the last 30 days, 3 known versions, newest CVE from 2023-01-11. Vendor: Amd.

CVEs of 3rd Gen Epyc

• CVE-2023-20531 - CVSS 7.5 (high), 2023-01-11: Insufficient bound checks in the SMU may allow an attacker to update the SRAM from/to address space to an invalid value potentially resulting in a denial of…
• CVE-2023-20532 - CVSS 5.3 (medium), 2023-01-11: Insufficient input validation in the SMU may allow an attacker to improperly lock resources, potentially resulting in a denial of service.
• CVE-2023-20528 - CVSS 2.4 (low), 2023-01-11: Insufficient input validation in the SMU may allow a physical attacker to exfiltrate SMU memory contents over the I2C bus potentially leading to a loss of…
• CVE-2021-46767 - CVSS 6.1 (medium), 2023-01-11: Insufficient input validation in the ASP may allow an attacker with physical access, unauthorized write access to memory potentially leading to a loss of…
• CVE-2021-46791 - CVSS 5.5 (medium), 2023-01-11: Insufficient input validation during parsing of the System Management Mode (SMM) binary may allow a maliciously crafted SMM executable binary to corrupt…
• CVE-2023-20522 - CVSS 7.5 (high), 2023-01-11: Insufficient input validation in ASP may allow an attacker with a malicious BIOS to potentially cause a denial of service.
• CVE-2023-20527 - CVSS 6.5 (medium), 2023-01-11: Improper syscall input validation in the ASP Bootloader may allow a privileged attacker to read memory out-of-bounds, potentially leading to a…
• CVE-2023-20530 - CVSS 7.5 (high), 2023-01-11: Insufficient input validation of BIOS mailbox messages in SMU may result in out-of-bounds memory reads potentially resulting in a denial of service.
• CVE-2021-46779 - CVSS 7.1 (high), 2023-01-11: Insufficient input validation in SVC_ECC_PRIMITIVE system call in a compromised user application or ABL may allow an attacker to corrupt ASP (AMD Secure…
• CVE-2022-23814 - CVSS 5.3 (medium), 2023-01-11: Failure to validate addresses provided by software to BIOS commands may result in a potential loss of integrity of guest memory in a confidential compute…
• CVE-2023-20525 - CVSS 6.5 (medium), 2023-01-11: Insufficient syscall input validation in the ASP Bootloader may allow a privileged attacker to read memory outside the bounds of a mapped register potentially…
• CVE-2023-20529 - CVSS 7.5 (high), 2023-01-11: Insufficient bound checks in the SMU may allow an attacker to update the from/to address space to an invalid value potentially resulting in a denial of service.
• CVE-2021-46768 - CVSS 5.5 (medium), 2023-01-11: Insufficient input validation in SEV firmware may allow an attacker to perform out-of-bounds memory reads within the ASP boot loader, potentially leading to a…
• CVE-2022-23813 - CVSS 5.3 (medium), 2023-01-11: The software interfaces to ASP and SMU may not enforce the SNP memory security policy resulting in a potential loss of integrity of guest memory in a…
• CVE-2023-20523 - CVSS 5.7 (medium), 2023-01-11: TOCTOU in the ASP may allow a physical attacker to write beyond the buffer bounds, potentially leading to a loss of integrity or denial of service.
• CVE-2021-26355 - CVSS 5.5 (medium), 2023-01-11: Insufficient fencing and checks in System Management Unit (SMU) may result in access to invalid message port registers that could result in a potential…
• CVE-2021-26402 - CVSS 7.1 (high), 2023-01-11: Insufficient bounds checking in ASP (AMD Secure Processor) firmware while handling BIOS mailbox commands, may allow an attacker to write partially-controlled…
• CVE-2021-26398 - CVSS 7.8 (high), 2023-01-11: Insufficient input validation in SYS_KEY_DERIVE system call in a compromised user application or ABL may allow an attacker to corrupt ASP (AMD Secure…
• CVE-2021-26409 - CVSS 7.8 (high), 2023-01-11: Insufficient bounds checking in SEV-ES may allow an attacker to corrupt Reverse Map table (RMP) memory, potentially resulting in a loss of SNP (Secure Nested…
• CVE-2021-26396 - CVSS 4.4 (medium), 2023-01-11: Insufficient validation of address mapping to IO in ASP (AMD Secure Processor) may result in a loss of memory integrity in the SNP guest.
• CVE-2021-26404 - CVSS 5.5 (medium), 2023-01-11: Improper input validation and bounds checking in SEV firmware may leak scratch buffer bytes leading to potential information disclosure.
• CVE-2021-26343 - CVSS 5.5 (medium), 2023-01-11: Insufficient validation in ASP BIOS and DRTM commands may allow malicious supervisor x86 software to disclose the contents of sensitive memory which may…
• CVE-2021-26328 - CVSS 4.4 (medium), 2023-01-11: Failure to verify the mode of CPU execution at the time of SNP_INIT may lead to a potential loss of memory integrity for SNP guests.
• CVE-2021-26316 - CVSS 7.8 (high), 2023-01-11: Failure to validate the communication buffer and communication service in the BIOS may allow an attacker to tamper with the buffer resulting in potential SMM…
• CVE-2021-26353 - CVSS 7.8 (high), 2022-05-10: Failure to validate inputs in SMM may allow an attacker to create a mishandled error leaving the DRTM UApp in a partially initialized state potentially…
• CVE-2021-39298 - CVSS 8.8 (high), 2022-02-16: A potential vulnerability in AMD System Management Mode (SMM) interrupt handler may allow an attacker with high privileges to access the SMM resulting in…