Vulnerability-Lookup

WID-SEC-W-2023-0061

Vulnerability from csaf_certbund - Published: 2023-01-10 23:00 - Updated: 2023-05-10 22:00

Summary

AMD Prozessoren: Mehrere Schwachstellen

Severity

Mittel

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: Prozessoren sind die zentralen Rechenwerke eines Computers.

Angriff: Ein lokaler Angreifer kann mehrere Schwachstellen in AMD Prozessoren ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen und Daten zu manipulieren.

Betroffene Betriebssysteme: - BIOS/Firmware

CVE-2021-26316

Es existieren mehrere Schwachstellen in AMD Prozessoren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen und Daten zu manipulieren.

Affected products

Known affected 6 products

Product	Identifier	Version
Lenovo BIOS Lenovo	`cpe:/h:lenovo:bios:-`	—
Dell Computer Dell	`cpe:/o:dell:dell_computer:-`	—
Lenovo Computer Lenovo	`cpe:/o:lenovo:lenovo_computer:-`	—
HP Computer HP	`cpe:/h:hp:computer:-`	—
AMD Prozessor AMD	`cpe:/h:amd:amd_processor:-`	—
HPE ProLiant HPE	`cpe:/h:hp:proliant:-`	—

CVE-2021-26328

Affected products

Known affected 6 products

Product	Identifier	Version
Lenovo BIOS Lenovo	`cpe:/h:lenovo:bios:-`	—
Dell Computer Dell	`cpe:/o:dell:dell_computer:-`	—
Lenovo Computer Lenovo	`cpe:/o:lenovo:lenovo_computer:-`	—
HP Computer HP	`cpe:/h:hp:computer:-`	—
AMD Prozessor AMD	`cpe:/h:amd:amd_processor:-`	—
HPE ProLiant HPE	`cpe:/h:hp:proliant:-`	—

CVE-2021-26343

Affected products

Known affected 6 products

Product	Identifier	Version
Lenovo BIOS Lenovo	`cpe:/h:lenovo:bios:-`	—
Dell Computer Dell	`cpe:/o:dell:dell_computer:-`	—
Lenovo Computer Lenovo	`cpe:/o:lenovo:lenovo_computer:-`	—
HP Computer HP	`cpe:/h:hp:computer:-`	—
AMD Prozessor AMD	`cpe:/h:amd:amd_processor:-`	—
HPE ProLiant HPE	`cpe:/h:hp:proliant:-`	—

CVE-2021-26346

Affected products

Known affected 6 products

Product	Identifier	Version
Lenovo BIOS Lenovo	`cpe:/h:lenovo:bios:-`	—
Dell Computer Dell	`cpe:/o:dell:dell_computer:-`	—
Lenovo Computer Lenovo	`cpe:/o:lenovo:lenovo_computer:-`	—
HP Computer HP	`cpe:/h:hp:computer:-`	—
AMD Prozessor AMD	`cpe:/h:amd:amd_processor:-`	—
HPE ProLiant HPE	`cpe:/h:hp:proliant:-`	—

CVE-2021-26353

Affected products

Known affected 6 products

Product	Identifier	Version
Lenovo BIOS Lenovo	`cpe:/h:lenovo:bios:-`	—
Dell Computer Dell	`cpe:/o:dell:dell_computer:-`	—
Lenovo Computer Lenovo	`cpe:/o:lenovo:lenovo_computer:-`	—
HP Computer HP	`cpe:/h:hp:computer:-`	—
AMD Prozessor AMD	`cpe:/h:amd:amd_processor:-`	—
HPE ProLiant HPE	`cpe:/h:hp:proliant:-`	—

CVE-2021-26355

Affected products

Known affected 6 products

Product	Identifier	Version
Lenovo BIOS Lenovo	`cpe:/h:lenovo:bios:-`	—
Dell Computer Dell	`cpe:/o:dell:dell_computer:-`	—
Lenovo Computer Lenovo	`cpe:/o:lenovo:lenovo_computer:-`	—
HP Computer HP	`cpe:/h:hp:computer:-`	—
AMD Prozessor AMD	`cpe:/h:amd:amd_processor:-`	—
HPE ProLiant HPE	`cpe:/h:hp:proliant:-`	—

CVE-2021-26391

Affected products

Known affected 6 products

Product	Identifier	Version
Lenovo BIOS Lenovo	`cpe:/h:lenovo:bios:-`	—
Dell Computer Dell	`cpe:/o:dell:dell_computer:-`	—
Lenovo Computer Lenovo	`cpe:/o:lenovo:lenovo_computer:-`	—
HP Computer HP	`cpe:/h:hp:computer:-`	—
AMD Prozessor AMD	`cpe:/h:amd:amd_processor:-`	—
HPE ProLiant HPE	`cpe:/h:hp:proliant:-`	—

CVE-2021-26396

Affected products

Known affected 6 products

Product	Identifier	Version
Lenovo BIOS Lenovo	`cpe:/h:lenovo:bios:-`	—
Dell Computer Dell	`cpe:/o:dell:dell_computer:-`	—
Lenovo Computer Lenovo	`cpe:/o:lenovo:lenovo_computer:-`	—
HP Computer HP	`cpe:/h:hp:computer:-`	—
AMD Prozessor AMD	`cpe:/h:amd:amd_processor:-`	—
HPE ProLiant HPE	`cpe:/h:hp:proliant:-`	—

CVE-2021-26398

Affected products

Known affected 6 products

Product	Identifier	Version
Lenovo BIOS Lenovo	`cpe:/h:lenovo:bios:-`	—
Dell Computer Dell	`cpe:/o:dell:dell_computer:-`	—
Lenovo Computer Lenovo	`cpe:/o:lenovo:lenovo_computer:-`	—
HP Computer HP	`cpe:/h:hp:computer:-`	—
AMD Prozessor AMD	`cpe:/h:amd:amd_processor:-`	—
HPE ProLiant HPE	`cpe:/h:hp:proliant:-`	—

CVE-2021-26402

Affected products

Known affected 6 products

Product	Identifier	Version
Lenovo BIOS Lenovo	`cpe:/h:lenovo:bios:-`	—
Dell Computer Dell	`cpe:/o:dell:dell_computer:-`	—
Lenovo Computer Lenovo	`cpe:/o:lenovo:lenovo_computer:-`	—
HP Computer HP	`cpe:/h:hp:computer:-`	—
AMD Prozessor AMD	`cpe:/h:amd:amd_processor:-`	—
HPE ProLiant HPE	`cpe:/h:hp:proliant:-`	—

CVE-2021-26403

Affected products

Known affected 6 products

Product	Identifier	Version
Lenovo BIOS Lenovo	`cpe:/h:lenovo:bios:-`	—
Dell Computer Dell	`cpe:/o:dell:dell_computer:-`	—
Lenovo Computer Lenovo	`cpe:/o:lenovo:lenovo_computer:-`	—
HP Computer HP	`cpe:/h:hp:computer:-`	—
AMD Prozessor AMD	`cpe:/h:amd:amd_processor:-`	—
HPE ProLiant HPE	`cpe:/h:hp:proliant:-`	—

CVE-2021-26404

Affected products

Known affected 6 products

Product	Identifier	Version
Lenovo BIOS Lenovo	`cpe:/h:lenovo:bios:-`	—
Dell Computer Dell	`cpe:/o:dell:dell_computer:-`	—
Lenovo Computer Lenovo	`cpe:/o:lenovo:lenovo_computer:-`	—
HP Computer HP	`cpe:/h:hp:computer:-`	—
AMD Prozessor AMD	`cpe:/h:amd:amd_processor:-`	—
HPE ProLiant HPE	`cpe:/h:hp:proliant:-`	—

CVE-2021-26407

Affected products

Known affected 6 products

Product	Identifier	Version
Lenovo BIOS Lenovo	`cpe:/h:lenovo:bios:-`	—
Dell Computer Dell	`cpe:/o:dell:dell_computer:-`	—
Lenovo Computer Lenovo	`cpe:/o:lenovo:lenovo_computer:-`	—
HP Computer HP	`cpe:/h:hp:computer:-`	—
AMD Prozessor AMD	`cpe:/h:amd:amd_processor:-`	—
HPE ProLiant HPE	`cpe:/h:hp:proliant:-`	—

CVE-2021-26409

Affected products

Known affected 6 products

Product	Identifier	Version
Lenovo BIOS Lenovo	`cpe:/h:lenovo:bios:-`	—
Dell Computer Dell	`cpe:/o:dell:dell_computer:-`	—
Lenovo Computer Lenovo	`cpe:/o:lenovo:lenovo_computer:-`	—
HP Computer HP	`cpe:/h:hp:computer:-`	—
AMD Prozessor AMD	`cpe:/h:amd:amd_processor:-`	—
HPE ProLiant HPE	`cpe:/h:hp:proliant:-`	—

CVE-2021-39298

Affected products

Known affected 6 products

Product	Identifier	Version
Lenovo BIOS Lenovo	`cpe:/h:lenovo:bios:-`	—
Dell Computer Dell	`cpe:/o:dell:dell_computer:-`	—
Lenovo Computer Lenovo	`cpe:/o:lenovo:lenovo_computer:-`	—
HP Computer HP	`cpe:/h:hp:computer:-`	—
AMD Prozessor AMD	`cpe:/h:amd:amd_processor:-`	—
HPE ProLiant HPE	`cpe:/h:hp:proliant:-`	—

CVE-2021-46767

Affected products

Known affected 6 products

Product	Identifier	Version
Lenovo BIOS Lenovo	`cpe:/h:lenovo:bios:-`	—
Dell Computer Dell	`cpe:/o:dell:dell_computer:-`	—
Lenovo Computer Lenovo	`cpe:/o:lenovo:lenovo_computer:-`	—
HP Computer HP	`cpe:/h:hp:computer:-`	—
AMD Prozessor AMD	`cpe:/h:amd:amd_processor:-`	—
HPE ProLiant HPE	`cpe:/h:hp:proliant:-`	—

CVE-2021-46768

Affected products

Known affected 6 products

Product	Identifier	Version
Lenovo BIOS Lenovo	`cpe:/h:lenovo:bios:-`	—
Dell Computer Dell	`cpe:/o:dell:dell_computer:-`	—
Lenovo Computer Lenovo	`cpe:/o:lenovo:lenovo_computer:-`	—
HP Computer HP	`cpe:/h:hp:computer:-`	—
AMD Prozessor AMD	`cpe:/h:amd:amd_processor:-`	—
HPE ProLiant HPE	`cpe:/h:hp:proliant:-`	—

CVE-2021-46779

Affected products

Known affected 6 products

Product	Identifier	Version
Lenovo BIOS Lenovo	`cpe:/h:lenovo:bios:-`	—
Dell Computer Dell	`cpe:/o:dell:dell_computer:-`	—
Lenovo Computer Lenovo	`cpe:/o:lenovo:lenovo_computer:-`	—
HP Computer HP	`cpe:/h:hp:computer:-`	—
AMD Prozessor AMD	`cpe:/h:amd:amd_processor:-`	—
HPE ProLiant HPE	`cpe:/h:hp:proliant:-`	—

CVE-2021-46791

Affected products

Known affected 6 products

Product	Identifier	Version
Lenovo BIOS Lenovo	`cpe:/h:lenovo:bios:-`	—
Dell Computer Dell	`cpe:/o:dell:dell_computer:-`	—
Lenovo Computer Lenovo	`cpe:/o:lenovo:lenovo_computer:-`	—
HP Computer HP	`cpe:/h:hp:computer:-`	—
AMD Prozessor AMD	`cpe:/h:amd:amd_processor:-`	—
HPE ProLiant HPE	`cpe:/h:hp:proliant:-`	—

CVE-2021-46795

Affected products

Known affected 6 products

Product	Identifier	Version
Lenovo BIOS Lenovo	`cpe:/h:lenovo:bios:-`	—
Dell Computer Dell	`cpe:/o:dell:dell_computer:-`	—
Lenovo Computer Lenovo	`cpe:/o:lenovo:lenovo_computer:-`	—
HP Computer HP	`cpe:/h:hp:computer:-`	—
AMD Prozessor AMD	`cpe:/h:amd:amd_processor:-`	—
HPE ProLiant HPE	`cpe:/h:hp:proliant:-`	—

CVE-2022-23813

Affected products

Known affected 6 products

Product	Identifier	Version
Lenovo BIOS Lenovo	`cpe:/h:lenovo:bios:-`	—
Dell Computer Dell	`cpe:/o:dell:dell_computer:-`	—
Lenovo Computer Lenovo	`cpe:/o:lenovo:lenovo_computer:-`	—
HP Computer HP	`cpe:/h:hp:computer:-`	—
AMD Prozessor AMD	`cpe:/h:amd:amd_processor:-`	—
HPE ProLiant HPE	`cpe:/h:hp:proliant:-`	—

CVE-2022-23814

Affected products

Known affected 6 products

Product	Identifier	Version
Lenovo BIOS Lenovo	`cpe:/h:lenovo:bios:-`	—
Dell Computer Dell	`cpe:/o:dell:dell_computer:-`	—
Lenovo Computer Lenovo	`cpe:/o:lenovo:lenovo_computer:-`	—
HP Computer HP	`cpe:/h:hp:computer:-`	—
AMD Prozessor AMD	`cpe:/h:amd:amd_processor:-`	—
HPE ProLiant HPE	`cpe:/h:hp:proliant:-`	—

CVE-2023-20522

Affected products

Known affected 6 products

Product	Identifier	Version
Lenovo BIOS Lenovo	`cpe:/h:lenovo:bios:-`	—
Dell Computer Dell	`cpe:/o:dell:dell_computer:-`	—
Lenovo Computer Lenovo	`cpe:/o:lenovo:lenovo_computer:-`	—
HP Computer HP	`cpe:/h:hp:computer:-`	—
AMD Prozessor AMD	`cpe:/h:amd:amd_processor:-`	—
HPE ProLiant HPE	`cpe:/h:hp:proliant:-`	—

CVE-2023-20523

Affected products

Known affected 6 products

Product	Identifier	Version
Lenovo BIOS Lenovo	`cpe:/h:lenovo:bios:-`	—
Dell Computer Dell	`cpe:/o:dell:dell_computer:-`	—
Lenovo Computer Lenovo	`cpe:/o:lenovo:lenovo_computer:-`	—
HP Computer HP	`cpe:/h:hp:computer:-`	—
AMD Prozessor AMD	`cpe:/h:amd:amd_processor:-`	—
HPE ProLiant HPE	`cpe:/h:hp:proliant:-`	—

CVE-2023-20525

Affected products

Known affected 6 products

Product	Identifier	Version
Lenovo BIOS Lenovo	`cpe:/h:lenovo:bios:-`	—
Dell Computer Dell	`cpe:/o:dell:dell_computer:-`	—
Lenovo Computer Lenovo	`cpe:/o:lenovo:lenovo_computer:-`	—
HP Computer HP	`cpe:/h:hp:computer:-`	—
AMD Prozessor AMD	`cpe:/h:amd:amd_processor:-`	—
HPE ProLiant HPE	`cpe:/h:hp:proliant:-`	—

CVE-2023-20527

Affected products

Known affected 6 products

Product	Identifier	Version
Lenovo BIOS Lenovo	`cpe:/h:lenovo:bios:-`	—
Dell Computer Dell	`cpe:/o:dell:dell_computer:-`	—
Lenovo Computer Lenovo	`cpe:/o:lenovo:lenovo_computer:-`	—
HP Computer HP	`cpe:/h:hp:computer:-`	—
AMD Prozessor AMD	`cpe:/h:amd:amd_processor:-`	—
HPE ProLiant HPE	`cpe:/h:hp:proliant:-`	—

CVE-2023-20528

Affected products

Known affected 6 products

Product	Identifier	Version
Lenovo BIOS Lenovo	`cpe:/h:lenovo:bios:-`	—
Dell Computer Dell	`cpe:/o:dell:dell_computer:-`	—
Lenovo Computer Lenovo	`cpe:/o:lenovo:lenovo_computer:-`	—
HP Computer HP	`cpe:/h:hp:computer:-`	—
AMD Prozessor AMD	`cpe:/h:amd:amd_processor:-`	—
HPE ProLiant HPE	`cpe:/h:hp:proliant:-`	—

CVE-2023-20529

Affected products

Known affected 6 products

Product	Identifier	Version
Lenovo BIOS Lenovo	`cpe:/h:lenovo:bios:-`	—
Dell Computer Dell	`cpe:/o:dell:dell_computer:-`	—
Lenovo Computer Lenovo	`cpe:/o:lenovo:lenovo_computer:-`	—
HP Computer HP	`cpe:/h:hp:computer:-`	—
AMD Prozessor AMD	`cpe:/h:amd:amd_processor:-`	—
HPE ProLiant HPE	`cpe:/h:hp:proliant:-`	—

CVE-2023-20530

Affected products

Known affected 6 products

Product	Identifier	Version
Lenovo BIOS Lenovo	`cpe:/h:lenovo:bios:-`	—
Dell Computer Dell	`cpe:/o:dell:dell_computer:-`	—
Lenovo Computer Lenovo	`cpe:/o:lenovo:lenovo_computer:-`	—
HP Computer HP	`cpe:/h:hp:computer:-`	—
AMD Prozessor AMD	`cpe:/h:amd:amd_processor:-`	—
HPE ProLiant HPE	`cpe:/h:hp:proliant:-`	—

CVE-2023-20531

Affected products

Known affected 6 products

Product	Identifier	Version
Lenovo BIOS Lenovo	`cpe:/h:lenovo:bios:-`	—
Dell Computer Dell	`cpe:/o:dell:dell_computer:-`	—
Lenovo Computer Lenovo	`cpe:/o:lenovo:lenovo_computer:-`	—
HP Computer HP	`cpe:/h:hp:computer:-`	—
AMD Prozessor AMD	`cpe:/h:amd:amd_processor:-`	—
HPE ProLiant HPE	`cpe:/h:hp:proliant:-`	—

CVE-2023-20532

Affected products

Known affected 6 products

Product	Identifier	Version
Lenovo BIOS Lenovo	`cpe:/h:lenovo:bios:-`	—
Dell Computer Dell	`cpe:/o:dell:dell_computer:-`	—
Lenovo Computer Lenovo	`cpe:/o:lenovo:lenovo_computer:-`	—
HP Computer HP	`cpe:/h:hp:computer:-`	—
AMD Prozessor AMD	`cpe:/h:amd:amd_processor:-`	—
HPE ProLiant HPE	`cpe:/h:hp:proliant:-`	—

References

11 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://support.lenovo.com/de/de/product_security…	external
https://support.hp.com/us-en/document/ish_8109529…	external
https://www.dell.com/support/kbdoc/de-de/00020737…	external
https://www.amd.com/en/corporate/product-security…	external
https://www.amd.com/en/corporate/product-security…	external
https://support.lenovo.com/de/de/product_security…	external
https://support.lenovo.com/de/de/product_security…	external
https://support.hp.com/us-en/document/ish_7491443…	external
https://support.hpe.com/hpesc/public/docDisplay?d…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Prozessoren sind die zentralen Rechenwerke eines Computers.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein lokaler Angreifer kann mehrere Schwachstellen in AMD Prozessoren ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen und Daten zu manipulieren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- BIOS/Firmware",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2023-0061 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-0061.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2023-0061 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-0061"
      },
      {
        "category": "external",
        "summary": "Lenovo Security Advisory: LEN-124495",
        "url": "https://support.lenovo.com/de/de/product_security/ps500559-multi-vendor-bios-security-vulnerabilities-may-2023"
      },
      {
        "category": "external",
        "summary": "HP Security Bulletin HPSBHF03846 vom 2023-05-11",
        "url": "https://support.hp.com/us-en/document/ish_8109529-8109560-16/HPSBHF03846"
      },
      {
        "category": "external",
        "summary": "Dell Security Advisory DSA-2023-002",
        "url": "https://www.dell.com/support/kbdoc/de-de/000207371/dsa-2023-002-dell-poweredge-server-security-update-for-amd-server-vulnerabilities"
      },
      {
        "category": "external",
        "summary": "AMD Client Vulnerabilities - January 2023 vom 2023-01-10",
        "url": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1031"
      },
      {
        "category": "external",
        "summary": "AMD Server Vulnerabilities - January 2023 vom 2023-01-10",
        "url": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1032"
      },
      {
        "category": "external",
        "summary": "Lenovo Security Advisory vom 2023-01-10",
        "url": "https://support.lenovo.com/de/de/product_security/ps500538-amd-server-vulnerabilities-january-2023"
      },
      {
        "category": "external",
        "summary": "Lenovo Security Advisory vom 2023-01-10",
        "url": "https://support.lenovo.com/de/de/product_security/ps500539-amd-client-vulnerabilities-january-2023"
      },
      {
        "category": "external",
        "summary": "HP Security Bulletin HPSBHF03831 vom 2023-01-11",
        "url": "https://support.hp.com/us-en/document/ish_7491443-7491471-16/HPSBHF03831"
      },
      {
        "category": "external",
        "summary": "HPE Security Bulletin",
        "url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbhf04404"
      }
    ],
    "source_lang": "en-US",
    "title": "AMD Prozessoren: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2023-05-10T22:00:00.000+00:00",
      "generator": {
        "date": "2024-08-15T17:41:05.996+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.5"
        }
      },
      "id": "WID-SEC-W-2023-0061",
      "initial_release_date": "2023-01-10T23:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2023-01-10T23:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2023-01-11T23:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von HP aufgenommen"
        },
        {
          "date": "2023-01-22T23:00:00.000+00:00",
          "number": "3",
          "summary": "Neue Updates von HP aufgenommen"
        },
        {
          "date": "2023-04-02T22:00:00.000+00:00",
          "number": "4",
          "summary": "Neue Updates von Dell aufgenommen"
        },
        {
          "date": "2023-05-10T22:00:00.000+00:00",
          "number": "5",
          "summary": "Neue Updates von HP und LENOVO aufgenommen"
        }
      ],
      "status": "final",
      "version": "5"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "AMD Prozessor",
            "product": {
              "name": "AMD Prozessor",
              "product_id": "T019554",
              "product_identification_helper": {
                "cpe": "cpe:/h:amd:amd_processor:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "AMD"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Dell Computer",
            "product": {
              "name": "Dell Computer",
              "product_id": "T006498",
              "product_identification_helper": {
                "cpe": "cpe:/o:dell:dell_computer:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Dell"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "HP Computer",
            "product": {
              "name": "HP Computer",
              "product_id": "T023191",
              "product_identification_helper": {
                "cpe": "cpe:/h:hp:computer:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "HP"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "HPE ProLiant",
            "product": {
              "name": "HPE ProLiant",
              "product_id": "T009310",
              "product_identification_helper": {
                "cpe": "cpe:/h:hp:proliant:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "HPE"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Lenovo BIOS",
            "product": {
              "name": "Lenovo BIOS",
              "product_id": "T005651",
              "product_identification_helper": {
                "cpe": "cpe:/h:lenovo:bios:-"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Lenovo Computer",
            "product": {
              "name": "Lenovo Computer",
              "product_id": "T006520",
              "product_identification_helper": {
                "cpe": "cpe:/o:lenovo:lenovo_computer:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Lenovo"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-26316",
      "notes": [
        {
          "category": "description",
          "text": "Es existieren mehrere Schwachstellen in AMD Prozessoren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen und Daten zu manipulieren."
        }
      ],
      "product_status": {
        "known_affected": [
          "T005651",
          "T006498",
          "T006520",
          "T023191",
          "T019554",
          "T009310"
        ]
      },
      "release_date": "2023-01-10T23:00:00.000+00:00",
      "title": "CVE-2021-26316"
    },
    {
      "cve": "CVE-2021-26328",
      "notes": [
        {
          "category": "description",
          "text": "Es existieren mehrere Schwachstellen in AMD Prozessoren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen und Daten zu manipulieren."
        }
      ],
      "product_status": {
        "known_affected": [
          "T005651",
          "T006498",
          "T006520",
          "T023191",
          "T019554",
          "T009310"
        ]
      },
      "release_date": "2023-01-10T23:00:00.000+00:00",
      "title": "CVE-2021-26328"
    },
    {
      "cve": "CVE-2021-26343",
      "notes": [
        {
          "category": "description",
          "text": "Es existieren mehrere Schwachstellen in AMD Prozessoren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen und Daten zu manipulieren."
        }
      ],
      "product_status": {
        "known_affected": [
          "T005651",
          "T006498",
          "T006520",
          "T023191",
          "T019554",
          "T009310"
        ]
      },
      "release_date": "2023-01-10T23:00:00.000+00:00",
      "title": "CVE-2021-26343"
    },
    {
      "cve": "CVE-2021-26346",
      "notes": [
        {
          "category": "description",
          "text": "Es existieren mehrere Schwachstellen in AMD Prozessoren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen und Daten zu manipulieren."
        }
      ],
      "product_status": {
        "known_affected": [
          "T005651",
          "T006498",
          "T006520",
          "T023191",
          "T019554",
          "T009310"
        ]
      },
      "release_date": "2023-01-10T23:00:00.000+00:00",
      "title": "CVE-2021-26346"
    },
    {
      "cve": "CVE-2021-26353",
      "notes": [
        {
          "category": "description",
          "text": "Es existieren mehrere Schwachstellen in AMD Prozessoren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen und Daten zu manipulieren."
        }
      ],
      "product_status": {
        "known_affected": [
          "T005651",
          "T006498",
          "T006520",
          "T023191",
          "T019554",
          "T009310"
        ]
      },
      "release_date": "2023-01-10T23:00:00.000+00:00",
      "title": "CVE-2021-26353"
    },
    {
      "cve": "CVE-2021-26355",
      "notes": [
        {
          "category": "description",
          "text": "Es existieren mehrere Schwachstellen in AMD Prozessoren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen und Daten zu manipulieren."
        }
      ],
      "product_status": {
        "known_affected": [
          "T005651",
          "T006498",
          "T006520",
          "T023191",
          "T019554",
          "T009310"
        ]
      },
      "release_date": "2023-01-10T23:00:00.000+00:00",
      "title": "CVE-2021-26355"
    },
    {
      "cve": "CVE-2021-26391",
      "notes": [
        {
          "category": "description",
          "text": "Es existieren mehrere Schwachstellen in AMD Prozessoren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen und Daten zu manipulieren."
        }
      ],
      "product_status": {
        "known_affected": [
          "T005651",
          "T006498",
          "T006520",
          "T023191",
          "T019554",
          "T009310"
        ]
      },
      "release_date": "2023-01-10T23:00:00.000+00:00",
      "title": "CVE-2021-26391"
    },
    {
      "cve": "CVE-2021-26396",
      "notes": [
        {
          "category": "description",
          "text": "Es existieren mehrere Schwachstellen in AMD Prozessoren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen und Daten zu manipulieren."
        }
      ],
      "product_status": {
        "known_affected": [
          "T005651",
          "T006498",
          "T006520",
          "T023191",
          "T019554",
          "T009310"
        ]
      },
      "release_date": "2023-01-10T23:00:00.000+00:00",
      "title": "CVE-2021-26396"
    },
    {
      "cve": "CVE-2021-26398",
      "notes": [
        {
          "category": "description",
          "text": "Es existieren mehrere Schwachstellen in AMD Prozessoren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen und Daten zu manipulieren."
        }
      ],
      "product_status": {
        "known_affected": [
          "T005651",
          "T006498",
          "T006520",
          "T023191",
          "T019554",
          "T009310"
        ]
      },
      "release_date": "2023-01-10T23:00:00.000+00:00",
      "title": "CVE-2021-26398"
    },
    {
      "cve": "CVE-2021-26402",
      "notes": [
        {
          "category": "description",
          "text": "Es existieren mehrere Schwachstellen in AMD Prozessoren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen und Daten zu manipulieren."
        }
      ],
      "product_status": {
        "known_affected": [
          "T005651",
          "T006498",
          "T006520",
          "T023191",
          "T019554",
          "T009310"
        ]
      },
      "release_date": "2023-01-10T23:00:00.000+00:00",
      "title": "CVE-2021-26402"
    },
    {
      "cve": "CVE-2021-26403",
      "notes": [
        {
          "category": "description",
          "text": "Es existieren mehrere Schwachstellen in AMD Prozessoren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen und Daten zu manipulieren."
        }
      ],
      "product_status": {
        "known_affected": [
          "T005651",
          "T006498",
          "T006520",
          "T023191",
          "T019554",
          "T009310"
        ]
      },
      "release_date": "2023-01-10T23:00:00.000+00:00",
      "title": "CVE-2021-26403"
    },
    {
      "cve": "CVE-2021-26404",
      "notes": [
        {
          "category": "description",
          "text": "Es existieren mehrere Schwachstellen in AMD Prozessoren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen und Daten zu manipulieren."
        }
      ],
      "product_status": {
        "known_affected": [
          "T005651",
          "T006498",
          "T006520",
          "T023191",
          "T019554",
          "T009310"
        ]
      },
      "release_date": "2023-01-10T23:00:00.000+00:00",
      "title": "CVE-2021-26404"
    },
    {
      "cve": "CVE-2021-26407",
      "notes": [
        {
          "category": "description",
          "text": "Es existieren mehrere Schwachstellen in AMD Prozessoren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen und Daten zu manipulieren."
        }
      ],
      "product_status": {
        "known_affected": [
          "T005651",
          "T006498",
          "T006520",
          "T023191",
          "T019554",
          "T009310"
        ]
      },
      "release_date": "2023-01-10T23:00:00.000+00:00",
      "title": "CVE-2021-26407"
    },
    {
      "cve": "CVE-2021-26409",
      "notes": [
        {
          "category": "description",
          "text": "Es existieren mehrere Schwachstellen in AMD Prozessoren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen und Daten zu manipulieren."
        }
      ],
      "product_status": {
        "known_affected": [
          "T005651",
          "T006498",
          "T006520",
          "T023191",
          "T019554",
          "T009310"
        ]
      },
      "release_date": "2023-01-10T23:00:00.000+00:00",
      "title": "CVE-2021-26409"
    },
    {
      "cve": "CVE-2021-39298",
      "notes": [
        {
          "category": "description",
          "text": "Es existieren mehrere Schwachstellen in AMD Prozessoren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen und Daten zu manipulieren."
        }
      ],
      "product_status": {
        "known_affected": [
          "T005651",
          "T006498",
          "T006520",
          "T023191",
          "T019554",
          "T009310"
        ]
      },
      "release_date": "2023-01-10T23:00:00.000+00:00",
      "title": "CVE-2021-39298"
    },
    {
      "cve": "CVE-2021-46767",
      "notes": [
        {
          "category": "description",
          "text": "Es existieren mehrere Schwachstellen in AMD Prozessoren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen und Daten zu manipulieren."
        }
      ],
      "product_status": {
        "known_affected": [
          "T005651",
          "T006498",
          "T006520",
          "T023191",
          "T019554",
          "T009310"
        ]
      },
      "release_date": "2023-01-10T23:00:00.000+00:00",
      "title": "CVE-2021-46767"
    },
    {
      "cve": "CVE-2021-46768",
      "notes": [
        {
          "category": "description",
          "text": "Es existieren mehrere Schwachstellen in AMD Prozessoren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen und Daten zu manipulieren."
        }
      ],
      "product_status": {
        "known_affected": [
          "T005651",
          "T006498",
          "T006520",
          "T023191",
          "T019554",
          "T009310"
        ]
      },
      "release_date": "2023-01-10T23:00:00.000+00:00",
      "title": "CVE-2021-46768"
    },
    {
      "cve": "CVE-2021-46779",
      "notes": [
        {
          "category": "description",
          "text": "Es existieren mehrere Schwachstellen in AMD Prozessoren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen und Daten zu manipulieren."
        }
      ],
      "product_status": {
        "known_affected": [
          "T005651",
          "T006498",
          "T006520",
          "T023191",
          "T019554",
          "T009310"
        ]
      },
      "release_date": "2023-01-10T23:00:00.000+00:00",
      "title": "CVE-2021-46779"
    },
    {
      "cve": "CVE-2021-46791",
      "notes": [
        {
          "category": "description",
          "text": "Es existieren mehrere Schwachstellen in AMD Prozessoren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen und Daten zu manipulieren."
        }
      ],
      "product_status": {
        "known_affected": [
          "T005651",
          "T006498",
          "T006520",
          "T023191",
          "T019554",
          "T009310"
        ]
      },
      "release_date": "2023-01-10T23:00:00.000+00:00",
      "title": "CVE-2021-46791"
    },
    {
      "cve": "CVE-2021-46795",
      "notes": [
        {
          "category": "description",
          "text": "Es existieren mehrere Schwachstellen in AMD Prozessoren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen und Daten zu manipulieren."
        }
      ],
      "product_status": {
        "known_affected": [
          "T005651",
          "T006498",
          "T006520",
          "T023191",
          "T019554",
          "T009310"
        ]
      },
      "release_date": "2023-01-10T23:00:00.000+00:00",
      "title": "CVE-2021-46795"
    },
    {
      "cve": "CVE-2022-23813",
      "notes": [
        {
          "category": "description",
          "text": "Es existieren mehrere Schwachstellen in AMD Prozessoren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen und Daten zu manipulieren."
        }
      ],
      "product_status": {
        "known_affected": [
          "T005651",
          "T006498",
          "T006520",
          "T023191",
          "T019554",
          "T009310"
        ]
      },
      "release_date": "2023-01-10T23:00:00.000+00:00",
      "title": "CVE-2022-23813"
    },
    {
      "cve": "CVE-2022-23814",
      "notes": [
        {
          "category": "description",
          "text": "Es existieren mehrere Schwachstellen in AMD Prozessoren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen und Daten zu manipulieren."
        }
      ],
      "product_status": {
        "known_affected": [
          "T005651",
          "T006498",
          "T006520",
          "T023191",
          "T019554",
          "T009310"
        ]
      },
      "release_date": "2023-01-10T23:00:00.000+00:00",
      "title": "CVE-2022-23814"
    },
    {
      "cve": "CVE-2023-20522",
      "notes": [
        {
          "category": "description",
          "text": "Es existieren mehrere Schwachstellen in AMD Prozessoren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen und Daten zu manipulieren."
        }
      ],
      "product_status": {
        "known_affected": [
          "T005651",
          "T006498",
          "T006520",
          "T023191",
          "T019554",
          "T009310"
        ]
      },
      "release_date": "2023-01-10T23:00:00.000+00:00",
      "title": "CVE-2023-20522"
    },
    {
      "cve": "CVE-2023-20523",
      "notes": [
        {
          "category": "description",
          "text": "Es existieren mehrere Schwachstellen in AMD Prozessoren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen und Daten zu manipulieren."
        }
      ],
      "product_status": {
        "known_affected": [
          "T005651",
          "T006498",
          "T006520",
          "T023191",
          "T019554",
          "T009310"
        ]
      },
      "release_date": "2023-01-10T23:00:00.000+00:00",
      "title": "CVE-2023-20523"
    },
    {
      "cve": "CVE-2023-20525",
      "notes": [
        {
          "category": "description",
          "text": "Es existieren mehrere Schwachstellen in AMD Prozessoren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen und Daten zu manipulieren."
        }
      ],
      "product_status": {
        "known_affected": [
          "T005651",
          "T006498",
          "T006520",
          "T023191",
          "T019554",
          "T009310"
        ]
      },
      "release_date": "2023-01-10T23:00:00.000+00:00",
      "title": "CVE-2023-20525"
    },
    {
      "cve": "CVE-2023-20527",
      "notes": [
        {
          "category": "description",
          "text": "Es existieren mehrere Schwachstellen in AMD Prozessoren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen und Daten zu manipulieren."
        }
      ],
      "product_status": {
        "known_affected": [
          "T005651",
          "T006498",
          "T006520",
          "T023191",
          "T019554",
          "T009310"
        ]
      },
      "release_date": "2023-01-10T23:00:00.000+00:00",
      "title": "CVE-2023-20527"
    },
    {
      "cve": "CVE-2023-20528",
      "notes": [
        {
          "category": "description",
          "text": "Es existieren mehrere Schwachstellen in AMD Prozessoren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen und Daten zu manipulieren."
        }
      ],
      "product_status": {
        "known_affected": [
          "T005651",
          "T006498",
          "T006520",
          "T023191",
          "T019554",
          "T009310"
        ]
      },
      "release_date": "2023-01-10T23:00:00.000+00:00",
      "title": "CVE-2023-20528"
    },
    {
      "cve": "CVE-2023-20529",
      "notes": [
        {
          "category": "description",
          "text": "Es existieren mehrere Schwachstellen in AMD Prozessoren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen und Daten zu manipulieren."
        }
      ],
      "product_status": {
        "known_affected": [
          "T005651",
          "T006498",
          "T006520",
          "T023191",
          "T019554",
          "T009310"
        ]
      },
      "release_date": "2023-01-10T23:00:00.000+00:00",
      "title": "CVE-2023-20529"
    },
    {
      "cve": "CVE-2023-20530",
      "notes": [
        {
          "category": "description",
          "text": "Es existieren mehrere Schwachstellen in AMD Prozessoren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen und Daten zu manipulieren."
        }
      ],
      "product_status": {
        "known_affected": [
          "T005651",
          "T006498",
          "T006520",
          "T023191",
          "T019554",
          "T009310"
        ]
      },
      "release_date": "2023-01-10T23:00:00.000+00:00",
      "title": "CVE-2023-20530"
    },
    {
      "cve": "CVE-2023-20531",
      "notes": [
        {
          "category": "description",
          "text": "Es existieren mehrere Schwachstellen in AMD Prozessoren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen und Daten zu manipulieren."
        }
      ],
      "product_status": {
        "known_affected": [
          "T005651",
          "T006498",
          "T006520",
          "T023191",
          "T019554",
          "T009310"
        ]
      },
      "release_date": "2023-01-10T23:00:00.000+00:00",
      "title": "CVE-2023-20531"
    },
    {
      "cve": "CVE-2023-20532",
      "notes": [
        {
          "category": "description",
          "text": "Es existieren mehrere Schwachstellen in AMD Prozessoren. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen und Daten zu manipulieren."
        }
      ],
      "product_status": {
        "known_affected": [
          "T005651",
          "T006498",
          "T006520",
          "T023191",
          "T019554",
          "T009310"
        ]
      },
      "release_date": "2023-01-10T23:00:00.000+00:00",
      "title": "CVE-2023-20532"
    }
  ]
}

CVE-2021-26316 (GCVE-0-2021-26316)

Vulnerability from cvelistv5 – Published: 2023-01-10 19:46 – Updated: 2025-04-09 15:19

Summary

Failure to validate the communication buffer and communication service in the BIOS may allow an attacker to tamper with the buffer resulting in potential SMM (System Management Mode) arbitrary code execution.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

Assigner

AMD

References

2 references

URL	Tags
https://www.amd.com/en/corporate/product-security…	vendor-advisory
https://www.amd.com/en/corporate/product-security…	vendor-advisory

Impacted products

6 products

Vendor	Product	Version
AMD	Ryzen 5000 Series	Affected: various
AMD	Ryzen 2000 Series	Affected: various
AMD	Ryzen 3000 Series	Affected: various
AMD	1st Gen EPYC	Affected: various
AMD	2nd Gen EPYC	Affected: Various
AMD	3rd Gen EPYC	Affected: various

Date Public

2023-01-10 17:30

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T20:19:20.402Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1031"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2021-26316",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-09T15:18:38.823141Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-20",
                "description": "CWE-20 Improper Input Validation",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-09T15:19:17.090Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "packageName": "AGESA",
          "platforms": [
            "x86"
          ],
          "product": "Ryzen 5000 Series ",
          "vendor": " AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various "
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "AGESA",
          "platforms": [
            "x86"
          ],
          "product": "Ryzen 2000 Series",
          "vendor": " AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various "
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "AGESA",
          "platforms": [
            "x86"
          ],
          "product": "Ryzen 3000 Series",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various "
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "AGESA ",
          "platforms": [
            "x86"
          ],
          "product": "1st Gen EPYC ",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various "
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "AGESA",
          "platforms": [
            "x86"
          ],
          "product": "2nd Gen EPYC",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "Various "
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "AGESA",
          "platforms": [
            "x86"
          ],
          "product": "3rd Gen EPYC",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various "
            }
          ]
        }
      ],
      "datePublic": "2023-01-10T17:30:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Failure to validate the communication buffer and communication service in the BIOS may allow an attacker to tamper with the buffer resulting in potential SMM (System Management Mode) arbitrary code execution."
            }
          ],
          "value": "Failure to validate the communication buffer and communication service in the BIOS may allow an attacker to tamper with the buffer resulting in potential SMM (System Management Mode) arbitrary code execution."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-01-11T07:01:59.843Z",
        "orgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
        "shortName": "AMD"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1031"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032"
        }
      ],
      "source": {
        "advisory": "AMD-SB-1031, AMD-SB-1032",
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
    "assignerShortName": "AMD",
    "cveId": "CVE-2021-26316",
    "datePublished": "2023-01-10T19:46:46.575Z",
    "dateReserved": "2021-01-29T21:24:26.137Z",
    "dateUpdated": "2025-04-09T15:19:17.090Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-26328 (GCVE-0-2021-26328)

Vulnerability from cvelistv5 – Published: 2023-01-10 20:56 – Updated: 2025-04-09 15:11

Summary

Failure to verify the mode of CPU execution at the time of SNP_INIT may lead to a potential loss of memory integrity for SNP guests.

Severity

4.4 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

CWE

Assigner

AMD

References

1 reference

URL	Tags
https://www.amd.com/en/corporate/product-security…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
AMD	3rd Gen EPYC	Affected: various

Date Public

2023-01-10 17:30

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T20:19:20.263Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "LOW",
              "baseScore": 4.4,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "LOW",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2021-26328",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-09T15:11:51.526597Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-358",
                "description": "CWE-358 Improperly Implemented Security Check for Standard",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-09T15:11:57.590Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "AGESA",
          "platforms": [
            "x86"
          ],
          "product": "3rd Gen EPYC",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various "
            }
          ]
        }
      ],
      "datePublic": "2023-01-10T17:30:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Failure to verify the mode of CPU execution at the time of SNP_INIT may lead to a potential loss of memory integrity for SNP guests.\u003cbr\u003e\u003cbr\u003e\u003cbr\u003e"
            }
          ],
          "value": "Failure to verify the mode of CPU execution at the time of SNP_INIT may lead to a potential loss of memory integrity for SNP guests.\n\n\n"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-01-11T07:01:59.843Z",
        "orgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
        "shortName": "AMD"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032"
        }
      ],
      "source": {
        "advisory": "AMD-SB-1032",
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
    "assignerShortName": "AMD",
    "cveId": "CVE-2021-26328",
    "datePublished": "2023-01-10T20:56:33.464Z",
    "dateReserved": "2021-01-29T21:24:26.141Z",
    "dateUpdated": "2025-04-09T15:11:57.590Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-26343 (GCVE-0-2021-26343)

Vulnerability from cvelistv5 – Published: 2023-01-10 20:56 – Updated: 2025-04-09 13:25

Summary

Insufficient validation in ASP BIOS and DRTM commands may allow malicious supervisor x86 software to disclose the contents of sensitive memory which may result in information disclosure.

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE

Assigner

AMD

References

1 reference

URL	Tags
https://www.amd.com/en/corporate/product-security…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
AMD	3rd Gen EPYC	Affected: various

Date Public

2023-01-10 17:30

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T20:26:24.896Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "NONE",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2021-26343",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-09T13:24:06.614880Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-668",
                "description": "CWE-668 Exposure of Resource to Wrong Sphere",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-09T13:25:42.403Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "AGESA",
          "platforms": [
            "x86"
          ],
          "product": "3rd Gen EPYC",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various "
            }
          ]
        }
      ],
      "datePublic": "2023-01-10T17:30:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Insufficient validation in ASP BIOS and DRTM commands may allow malicious supervisor x86 software to disclose the contents of sensitive memory which may result in information disclosure.\u003cbr\u003e\u003cbr\u003e\u003cbr\u003e"
            }
          ],
          "value": "Insufficient validation in ASP BIOS and DRTM commands may allow malicious supervisor x86 software to disclose the contents of sensitive memory which may result in information disclosure.\n\n\n"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-01-11T07:01:59.843Z",
        "orgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
        "shortName": "AMD"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032"
        }
      ],
      "source": {
        "advisory": "AMD-SB-1032",
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
    "assignerShortName": "AMD",
    "cveId": "CVE-2021-26343",
    "datePublished": "2023-01-10T20:56:34.870Z",
    "dateReserved": "2021-01-29T21:24:26.144Z",
    "dateUpdated": "2025-04-09T13:25:42.403Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-26346 (GCVE-0-2021-26346)

Vulnerability from cvelistv5 – Published: 2023-01-10 19:50 – Updated: 2025-04-09 15:14

Summary

Failure to validate the integer operand in ASP (AMD Secure Processor) bootloader may allow an attacker to introduce an integer overflow in the L2 directory table in SPI flash resulting in a potential denial of service.

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE

Assigner

AMD

References

1 reference

URL	Tags
https://www.amd.com/en/corporate/product-security…

Impacted products

1 product

Vendor	Product	Version
AMD	Ryzen 5000 Series	Affected: various

Date Public

2023-01-10 17:30

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T20:26:24.647Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1031"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2021-26346",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-09T15:14:14.715212Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-190",
                "description": "CWE-190 Integer Overflow or Wraparound",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-09T15:14:19.086Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "packageName": "AGESA",
          "platforms": [
            "x86"
          ],
          "product": "Ryzen 5000 Series",
          "vendor": " AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various "
            }
          ]
        }
      ],
      "datePublic": "2023-01-10T17:30:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Failure to validate the integer operand in ASP (AMD Secure Processor) bootloader may allow an attacker to introduce an integer overflow in the L2 directory table in SPI flash resulting in a potential denial of service."
            }
          ],
          "value": "Failure to validate the integer operand in ASP (AMD Secure Processor) bootloader may allow an attacker to introduce an integer overflow in the L2 directory table in SPI flash resulting in a potential denial of service."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-01-11T07:01:59.843Z",
        "orgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
        "shortName": "AMD"
      },
      "references": [
        {
          "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1031"
        }
      ],
      "source": {
        "advisory": "AMD-SB-1031",
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
    "assignerShortName": "AMD",
    "cveId": "CVE-2021-26346",
    "datePublished": "2023-01-10T19:50:24.146Z",
    "dateReserved": "2021-01-29T21:24:26.146Z",
    "dateUpdated": "2025-04-09T15:14:19.086Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-26353 (GCVE-0-2021-26353)

Vulnerability from cvelistv5 – Published: 2022-05-10 18:33 – Updated: 2024-08-03 20:26

Summary

Failure to validate inputs in SMM may allow an attacker to create a mishandled error leaving the DRTM UApp in a partially initialized state potentially resulting in loss of memory integrity.

Severity

No CVSS data available.

CWE

Assigner

AMD

References

1 reference

URL	Tags
https://www.amd.com/en/corporate/product-security…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
AMD	3rd Gen EPYC	Affected: various

Date Public

2023-01-10 17:30

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T20:26:24.535Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "AGESA",
          "platforms": [
            "x86"
          ],
          "product": "3rd Gen EPYC",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        }
      ],
      "datePublic": "2023-01-10T17:30:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Failure to validate inputs in SMM may allow an attacker to create a mishandled error leaving the DRTM UApp in a partially initialized state potentially resulting in loss of memory integrity.\u003cbr\u003e\u003cbr\u003e"
            }
          ],
          "value": "Failure to validate inputs in SMM may allow an attacker to create a mishandled error leaving the DRTM UApp in a partially initialized state potentially resulting in loss of memory integrity."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-01-11T07:01:59.843Z",
        "orgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
        "shortName": "AMD"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032"
        }
      ],
      "source": {
        "advisory": "AMD-SB-1032",
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
    "assignerShortName": "AMD",
    "cveId": "CVE-2021-26353",
    "datePublished": "2022-05-10T18:33:42.470Z",
    "dateReserved": "2021-01-29T00:00:00.000Z",
    "dateUpdated": "2024-08-03T20:26:24.535Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-26355 (GCVE-0-2021-26355)

Vulnerability from cvelistv5 – Published: 2023-01-10 20:56 – Updated: 2025-04-09 14:56

Summary

Insufficient fencing and checks in System Management Unit (SMU) may result in access to invalid message port registers that could result in a potential denial-of-service.

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE

Assigner

AMD

References

1 reference

URL	Tags
https://www.amd.com/en/corporate/product-security…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
AMD	3rd Gen EPYC	Affected: various

Date Public

2023-01-10 17:30

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T20:26:25.057Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2021-26355",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-09T14:56:03.691250Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-693",
                "description": "CWE-693 Protection Mechanism Failure",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-09T14:56:35.656Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "AGESA",
          "platforms": [
            "x86"
          ],
          "product": "3rd Gen EPYC",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various "
            }
          ]
        }
      ],
      "datePublic": "2023-01-10T17:30:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Insufficient fencing and checks in System Management Unit (SMU) may result in access to invalid message port registers that could result in a potential denial-of-service.\u003cbr\u003e\u003cbr\u003e"
            }
          ],
          "value": "Insufficient fencing and checks in System Management Unit (SMU) may result in access to invalid message port registers that could result in a potential denial-of-service.\n\n"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-01-11T07:01:59.843Z",
        "orgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
        "shortName": "AMD"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032"
        }
      ],
      "source": {
        "advisory": "AMD-SB-1032",
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
    "assignerShortName": "AMD",
    "cveId": "CVE-2021-26355",
    "datePublished": "2023-01-10T20:56:37.810Z",
    "dateReserved": "2021-01-29T21:24:26.148Z",
    "dateUpdated": "2025-04-09T14:56:35.656Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-26391 (GCVE-0-2021-26391)

Vulnerability from cvelistv5 – Published: 2022-11-09 20:44 – Updated: 2025-05-01 14:19

Summary

Insufficient verification of multiple header signatures while loading a Trusted Application (TA) may allow an attacker with privileges to gain code execution in that TA or the OS/kernel.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

Assigner

AMD

References

1 reference

URL	Tags
https://www.amd.com/en/corporate/product-security…

Impacted products

2 products

Vendor	Product	Version
AMD	AMD Radeon RX 5000 Series & PRO W5000 Series	Affected: AMD Radeon Software , < 22.5.2 (custom) Affected: AMD Radeon Pro Software Enterprise , < 22.Q2 (custom) Affected: Enterprise Driver , < 22.10.20 (custom)
AMD	AMD Radeon RX 6000 Series & PRO W6000 Series	Affected: AMD Radeon Software , < 22.5.2 (custom) Affected: AMD Radeon Pro Software Enterprise , < 22.Q2 (custom) Affected: Enterprise Driver , < 22.10.20 (custom)

Date Public

2022-11-08 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T20:26:25.325Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1029"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2021-26391",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-01T14:19:01.036693Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-347",
                "description": "CWE-347 Improper Verification of Cryptographic Signature",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-01T14:19:25.590Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "AMD Radeon RX 5000 Series \u0026 PRO W5000 Series",
          "vendor": "AMD",
          "versions": [
            {
              "lessThan": "22.5.2",
              "status": "affected",
              "version": "AMD Radeon Software",
              "versionType": "custom"
            },
            {
              "lessThan": "22.Q2",
              "status": "affected",
              "version": "AMD Radeon Pro Software Enterprise",
              "versionType": "custom"
            },
            {
              "lessThan": "22.10.20",
              "status": "affected",
              "version": "Enterprise Driver",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "AMD Radeon RX 6000 Series \u0026 PRO W6000 Series",
          "vendor": "AMD",
          "versions": [
            {
              "lessThan": "22.5.2",
              "status": "affected",
              "version": "AMD Radeon Software",
              "versionType": "custom"
            },
            {
              "lessThan": "22.Q2",
              "status": "affected",
              "version": "AMD Radeon Pro Software Enterprise",
              "versionType": "custom"
            },
            {
              "lessThan": "22.10.20",
              "status": "affected",
              "version": "Enterprise Driver",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2022-11-08T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Insufficient verification of multiple header signatures while loading a Trusted Application (TA) may allow an attacker with privileges to gain code execution in that TA or the OS/kernel."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "TBD",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-11-09T00:00:00.000Z",
        "orgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
        "shortName": "AMD"
      },
      "references": [
        {
          "url": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1029"
        }
      ],
      "source": {
        "advisory": "AMD-SB-1029",
        "discovery": "EXTERNAL"
      },
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
    "assignerShortName": "AMD",
    "cveId": "CVE-2021-26391",
    "datePublished": "2022-11-09T20:44:25.253Z",
    "dateReserved": "2021-01-29T00:00:00.000Z",
    "dateUpdated": "2025-05-01T14:19:25.590Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-26396 (GCVE-0-2021-26396)

Vulnerability from cvelistv5 – Published: 2023-01-10 20:56 – Updated: 2025-04-09 14:54

Summary

Insufficient validation of address mapping to IO in ASP (AMD Secure Processor) may result in a loss of memory integrity in the SNP guest.

Severity

4.4 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

CWE

Assigner

AMD

References

1 reference

URL	Tags
https://www.amd.com/en/corporate/product-security…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
AMD	3rd Gen EPYC	Affected: various

Date Public

2023-01-10 17:30

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T20:26:25.145Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "LOW",
              "baseScore": 4.4,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "LOW",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2021-26396",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-09T14:54:48.208922Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-345",
                "description": "CWE-345 Insufficient Verification of Data Authenticity",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-09T14:54:52.802Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "AGESA",
          "platforms": [
            "x86"
          ],
          "product": "3rd Gen EPYC",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various "
            }
          ]
        }
      ],
      "datePublic": "2023-01-10T17:30:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Insufficient validation of address mapping to IO in ASP (AMD Secure Processor) may result in a loss of memory integrity in the SNP guest.\u003cbr\u003e\u003cbr\u003e"
            }
          ],
          "value": "Insufficient validation of address mapping to IO in ASP (AMD Secure Processor) may result in a loss of memory integrity in the SNP guest.\n\n"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-01-11T07:01:59.843Z",
        "orgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
        "shortName": "AMD"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032"
        }
      ],
      "source": {
        "advisory": "AMD-SB-1032",
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
    "assignerShortName": "AMD",
    "cveId": "CVE-2021-26396",
    "datePublished": "2023-01-10T20:56:39.130Z",
    "dateReserved": "2021-01-29T21:24:26.165Z",
    "dateUpdated": "2025-04-09T14:54:52.802Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-26398 (GCVE-0-2021-26398)

Vulnerability from cvelistv5 – Published: 2023-01-10 20:56 – Updated: 2025-04-09 14:38

Summary

Insufficient input validation in SYS_KEY_DERIVE system call in a compromised user application or ABL may allow an attacker to corrupt ASP (AMD Secure Processor) OS memory which may lead to potential arbitrary code execution.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

Assigner

AMD

References

1 reference

URL	Tags
https://www.amd.com/en/corporate/product-security…	vendor-advisory

Impacted products

3 products

Vendor	Product	Version
AMD	1st Gen EPYC	Affected: various
AMD	2nd Gen EPYC	Affected: Various
AMD	3rd Gen EPYC	Affected: various

Date Public

2023-01-10 17:30

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T20:26:24.878Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2021-26398",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-09T14:37:21.765798Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-787",
                "description": "CWE-787 Out-of-bounds Write",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-09T14:38:06.009Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "AGESA ",
          "platforms": [
            "x86"
          ],
          "product": "1st Gen EPYC ",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various "
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "AGESA",
          "platforms": [
            "x86"
          ],
          "product": "2nd Gen EPYC",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "Various "
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "AGESA",
          "platforms": [
            "x86"
          ],
          "product": "3rd Gen EPYC",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various "
            }
          ]
        }
      ],
      "datePublic": "2023-01-10T17:30:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Insufficient input validation in SYS_KEY_DERIVE system call in a compromised user application or ABL may allow an attacker to corrupt ASP (AMD Secure Processor) OS memory which may lead to potential arbitrary code execution.\u003cbr\u003e\u003cbr\u003e"
            }
          ],
          "value": "Insufficient input validation in SYS_KEY_DERIVE system call in a compromised user application or ABL may allow an attacker to corrupt ASP (AMD Secure Processor) OS memory which may lead to potential arbitrary code execution.\n\n"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-01-11T07:01:59.843Z",
        "orgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
        "shortName": "AMD"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032"
        }
      ],
      "source": {
        "advisory": "AMD-SB-1032",
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
    "assignerShortName": "AMD",
    "cveId": "CVE-2021-26398",
    "datePublished": "2023-01-10T20:56:40.452Z",
    "dateReserved": "2021-01-29T21:24:26.167Z",
    "dateUpdated": "2025-04-09T14:38:06.009Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-26402 (GCVE-0-2021-26402)

Vulnerability from cvelistv5 – Published: 2023-01-10 20:56 – Updated: 2025-04-08 20:27

Summary

Insufficient bounds checking in ASP (AMD Secure Processor) firmware while handling BIOS mailbox commands, may allow an attacker to write partially-controlled data out-of-bounds to SMM or SEV-ES regions which may lead to a potential loss of integrity and availability.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

CWE

Assigner

AMD

References

1 reference

URL	Tags
https://www.amd.com/en/corporate/product-security…	vendor-advisory

Impacted products

2 products

Vendor	Product	Version
AMD	2nd Gen EPYC	Affected: Various
AMD	3rd Gen EPYC	Affected: various

Date Public

2023-01-10 17:30

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T20:26:25.169Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2021-26402",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-08T20:26:11.401792Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-787",
                "description": "CWE-787 Out-of-bounds Write",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-08T20:27:13.237Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "AGESA",
          "platforms": [
            "x86"
          ],
          "product": "2nd Gen EPYC",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "Various "
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "AGESA",
          "platforms": [
            "x86"
          ],
          "product": "3rd Gen EPYC",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various "
            }
          ]
        }
      ],
      "datePublic": "2023-01-10T17:30:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Insufficient bounds checking in ASP (AMD Secure Processor) firmware while handling BIOS mailbox commands, may allow an attacker to write partially-controlled data out-of-bounds to SMM or SEV-ES regions which may lead to a potential loss of integrity and availability.\u003cbr\u003e\u003cbr\u003e"
            }
          ],
          "value": "Insufficient bounds checking in ASP (AMD Secure Processor) firmware while handling BIOS mailbox commands, may allow an attacker to write partially-controlled data out-of-bounds to SMM or SEV-ES regions which may lead to a potential loss of integrity and availability.\n\n"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-01-11T07:01:59.843Z",
        "orgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
        "shortName": "AMD"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032"
        }
      ],
      "source": {
        "advisory": "AMD-SB-1032",
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
    "assignerShortName": "AMD",
    "cveId": "CVE-2021-26402",
    "datePublished": "2023-01-10T20:56:41.784Z",
    "dateReserved": "2021-01-29T21:24:26.169Z",
    "dateUpdated": "2025-04-08T20:27:13.237Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

WID-SEC-W-2023-0061

CVE-2021-26316 (GCVE-0-2021-26316)

CVE-2021-26328 (GCVE-0-2021-26328)

CVE-2021-26343 (GCVE-0-2021-26343)

CVE-2021-26346 (GCVE-0-2021-26346)

CVE-2021-26353 (GCVE-0-2021-26353)

CVE-2021-26355 (GCVE-0-2021-26355)

CVE-2021-26391 (GCVE-0-2021-26391)

CVE-2021-26396 (GCVE-0-2021-26396)

CVE-2021-26398 (GCVE-0-2021-26398)

CVE-2021-26402 (GCVE-0-2021-26402)

Tags

Sightings

Nomenclature