Ryzen 5 5625u Firmware (Amd) - vulnerabilities (CVEs)

40 CVEs, 0 in the last 30 days, 9 known versions, newest CVE from 2024-08-13. Vendor: Amd.

CVEs of Ryzen 5 5625u Firmware

CVE-2022-23817 - CVSS 7.3 (high), 2024-08-13: Insufficient checking of memory buffer in AMD Secure Processor (ASP) Secure OS may allow an attacker with a malicious trusted application to read/write to the…
CVE-2023-20579 - CVSS 6 (medium), 2024-02-13: Improper Access Control in the AMD SPI protection feature may allow a user with Ring0 (kernel mode) privileged access to bypass protections potentially…
CVE-2023-20596 - CVSS 9.8 (critical), 2023-11-14: Improper input validation in the SMM Supervisor may allow an attacker with a compromised SMI handler to gain Ring0 access potentially leading to arbitrary…
CVE-2023-20571 - CVSS 8.1 (high), 2023-11-14: A race condition in System Management Mode (SMM) code may allow an attacker using a compromised user space to leverage CVE-2018-8897 potentially resulting in…
CVE-2023-20565 - CVSS 7.8 (high), 2023-11-14: Insufficient protections in System Management Mode (SMM) code may allow an attacker to potentially enable escalation of privilege via local access.
CVE-2023-20563 - CVSS 7.8 (high), 2023-11-14: Insufficient protections in System Management Mode (SMM) code may allow an attacker to potentially enable escalation of privilege via local access.
CVE-2022-23821 - CVSS 9.8 (critical), 2023-11-14: Improper access control in System Management Mode (SMM) may allow an attacker to write to SPI ROM potentially leading to arbitrary code execution.
CVE-2022-23820 - CVSS 9.8 (critical), 2023-11-14: Failure to validate the AMD SMM communication buffer may allow an attacker to corrupt the SMRAM potentially leading to arbitrary code execution.
CVE-2021-46758 - CVSS 6.1 (medium), 2023-11-14: Insufficient validation of SPI flash addresses in the ASP (AMD Secure Processor) bootloader may allow an attacker to read data in memory mapped beyond SPI…
CVE-2023-20597 - CVSS 5.5 (medium), 2023-09-20: Improper initialization of variables in the DXE driver may allow a privileged user to leak sensitive information via local access.
CVE-2023-20594 - CVSS 4.4 (medium), 2023-09-20: Improper initialization of variables in the DXE driver may allow a privileged user to leak sensitive information via local access.
CVE-2023-20555 - CVSS 7.8 (high), 2023-08-08: Insufficient input validation in CpmDisplayFeatureSmm may allow an attacker to corrupt SMM memory by overwriting an arbitrary bit in an attacker-controlled…
CVE-2023-20589 - CVSS 6.8 (medium), 2023-08-08: An attacker with specialized hardware and physical access to an impacted device may be able to perform a voltage fault injection attack resulting in…
CVE-2023-20569 - CVSS 4.7 (medium), 2023-08-08: A side channel vulnerability on some of the AMD CPUs may allow an attacker to influence the return address prediction. This may result in speculative…
CVE-2021-26354 - CVSS 5.5 (medium), 2023-05-09: Insufficient bounds checking in ASP may allow an attacker to issue a system call from a compromised ABL which may cause arbitrary memory values to be…
CVE-2023-20558 - CVSS 8.8 (high), 2023-04-02: Insufficient control flow management in AmdCpmOemSmm may allow a privileged attacker to tamper with the SMM handler potentially leading to an escalation of…
CVE-2023-20559 - CVSS 8.8 (high), 2023-04-02: Insufficient control flow management in AmdCpmGpioInitSmm may allow a privileged attacker to tamper with the SMM handler potentially leading to escalation of…
CVE-2022-27672 - CVSS 4.7 (medium), 2023-03-01: When SMT is enabled, certain AMD processors may speculatively execute instructions using a target from the sibling thread after an SMT mode switch potentially…
CVE-2021-26316 - CVSS 7.8 (high), 2023-01-11: Failure to validate the communication buffer and communication service in the BIOS may allow an attacker to tamper with the buffer resulting in potential SMM…
CVE-2021-26346 - CVSS 5.5 (medium), 2023-01-11: Failure to validate the integer operand in ASP (AMD Secure Processor) bootloader may allow an attacker to introduce an integer overflow in the L2 directory…
CVE-2022-23824 - CVSS 5.5 (medium), 2022-11-09: IBPB may not prevent return branch predictions from being specified by pre-IBPB branch targets leading to a potential information disclosure.
CVE-2021-46778 - CVSS 5.6 (medium), 2022-08-10: Execution unit scheduler contention may lead to a side channel vulnerability found on AMD CPU microarchitectures codenamed “Zen 1”, “Zen 2” and “Zen 3” that…
CVE-2021-26384 - CVSS 7.8 (high), 2022-07-14: A malformed SMI (System Management Interface) command may allow an attacker to establish a corrupted SMI Trigger Info data structure, potentially leading to…
CVE-2021-26382 - CVSS 4.4 (medium), 2022-07-14: An attacker with root account privileges can load any legitimately signed firmware image into the Audio Co-Processor (ACP,) irrespective of the respective…
CVE-2022-23823 - CVSS 6.5 (medium), 2022-06-15: A potential vulnerability in some AMD processors using frequency scaling may allow an authenticated attacker to execute a timing attack to potentially enable…
CVE-2021-26386 - CVSS 7.8 (high), 2022-05-12: A malicious or compromised UApp or ABL may be used by an attacker to issue a malformed system call to the Stage 2 Bootloader potentially leading to corrupt…
CVE-2021-26368 - CVSS 4.4 (medium), 2022-05-12: Insufficient check of the process type in Trusted OS (TOS) may allow an attacker with privileges to enable a lesser privileged process to unmap memory owned…
CVE-2021-26363 - CVSS 4.4 (medium), 2022-05-12: A malicious or compromised UApp or ABL could potentially change the value that the ASP uses for its reserved DRAM, to one outside of the fenced area,…
CVE-2021-26317 - CVSS 7.8 (high), 2022-05-12: Failure to verify the protocol in SMM may allow an attacker to control the protocol and modify SPI flash resulting in a potential arbitrary code execution.
CVE-2021-26361 - CVSS 5.5 (medium), 2022-05-12: A malicious or compromised User Application (UApp) or AGESA Boot Loader (ABL) could be used by an attacker to exfiltrate arbitrary memory from the ASP stage 2…
CVE-2021-26369 - CVSS 7.8 (high), 2022-05-12: A malicious or compromised UApp or ABL may be used by an attacker to send a malformed system call to the bootloader, resulting in out-of-bounds memory accesses.
CVE-2021-26351 - CVSS 5.5 (medium), 2022-05-12: Insufficient DRAM address validation in System Management Unit (SMU) may result in a DMA (Direct Memory Access) read/write from/to invalid DRAM address that…
CVE-2021-26366 - CVSS 7.1 (high), 2022-05-12: An attacker, who gained elevated privileges via some other vulnerability, may be able to read data from Boot ROM resulting in a loss of system integrity.
CVE-2021-26362 - CVSS 7.1 (high), 2022-05-12: A malicious or compromised UApp or ABL may be used by an attacker to issue a malformed system call which results in mapping sensitive System Management…
CVE-2021-26339 - CVSS 5.5 (medium), 2022-05-11: A bug in AMD CPU’s core logic may allow for an attacker, using specific code from an unprivileged VM, to trigger a CPU core hang resulting in a potential…
CVE-2021-26388 - CVSS 5.5 (medium), 2022-05-11: Improper validation of the BIOS directory may allow for searches to read beyond the directory table copy in RAM, exposing out of bounds memory contents,…
CVE-2021-26401 - CVSS 5.6 (medium), 2022-03-11: LFENCE/JMP (mitigation V2-2) may not sufficiently mitigate CVE-2017-5715 on some AMD CPUs.
CVE-2021-26341 - CVSS 6.5 (medium), 2022-03-11: Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage.
CVE-2021-26337 - CVSS 5.5 (medium), 2021-11-16: Insufficient DRAM address validation in System Management Unit (SMU) may result in a DMA read from invalid DRAM address to SRAM resulting in SMU not servicing…
CVE-2021-26336 - CVSS 5.5 (medium), 2021-11-16: Insufficient bounds checking in System Management Unit (SMU) may cause invalid memory accesses/updates that could result in SMU hang and subsequent failure to…