Vulnerability-Lookup

WID-SEC-W-2023-2916

Vulnerability from csaf_certbund - Published: 2023-11-14 23:00 - Updated: 2024-12-15 23:00

Summary

AMD Prozessor: Mehrere Schwachstellen

Severity

Mittel

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: Prozessoren sind die zentralen Rechenwerke eines Computers.

Angriff: Ein lokaler Angreifer kann mehrere Schwachstellen in AMD Prozessor ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand zu verursachen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen oder seine Privilegien zu erweitern.

Betroffene Betriebssysteme: - BIOS/Firmware

CVE-2021-26345

Es bestehen mehrere Schwachstellen in AMD Prozessor. Diese Fehler bestehen im AMD Secure Processor (ASP), AMD System Management Unit (SMU), AMD Secure Encrypted Virtualization (SEV), AMD Secure Encrypted Virtualization - Secure Nested Paging (SEV-SNP) und anderen Plattformkomponenten aufgrund verschiedener Sicherheitsprobleme wie einer unzureichenden Eingabevalidierung, einem "Use-After-Free", einer unsachgemäßen Adressvalidierung und anderen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand zu verursachen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen oder seine Privilegien zu erweitern.

Affected products

Known affected 15 products

Product	Identifier	Version
Lenovo BIOS Lenovo	`cpe:/h:lenovo:bios:-`	—
Dell Computer Dell	`cpe:/o:dell:dell_computer:-`	—
HP Computer HP / Computer	`cpe:/h:hp:computer:-`	—
Dell BIOS Dell / BIOS	`cpe:/h:dell:bios:-`	—
AMD Prozessor AMD / Prozessor	`cpe:/h:amd:amd_processor:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Dell BIOS Dell / BIOS	`cpe:/h:dell:bios:-`	—
HP Computer HP / Computer	`cpe:/h:hp:computer:-`	—
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
AMD Prozessor AMD / Prozessor	`cpe:/h:amd:amd_processor:-`	—
Lenovo Computer Lenovo	`cpe:/h:lenovo:computer:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Open Source CentOS Open Source	`cpe:/o:centos:centos:-`	—
HPE ProLiant HPE	`cpe:/h:hp:proliant:-`	—
IBM Power Hardware Management Console V10 IBM / Power Hardware Management Console	`cpe:/a:ibm:hardware_management_console:v10`	V10

CVE-2021-46758

Affected products

Known affected 15 products

Product	Identifier	Version
Lenovo BIOS Lenovo	`cpe:/h:lenovo:bios:-`	—
Dell Computer Dell	`cpe:/o:dell:dell_computer:-`	—
HP Computer HP / Computer	`cpe:/h:hp:computer:-`	—
Dell BIOS Dell / BIOS	`cpe:/h:dell:bios:-`	—
AMD Prozessor AMD / Prozessor	`cpe:/h:amd:amd_processor:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Dell BIOS Dell / BIOS	`cpe:/h:dell:bios:-`	—
HP Computer HP / Computer	`cpe:/h:hp:computer:-`	—
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
AMD Prozessor AMD / Prozessor	`cpe:/h:amd:amd_processor:-`	—
Lenovo Computer Lenovo	`cpe:/h:lenovo:computer:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Open Source CentOS Open Source	`cpe:/o:centos:centos:-`	—
HPE ProLiant HPE	`cpe:/h:hp:proliant:-`	—
IBM Power Hardware Management Console V10 IBM / Power Hardware Management Console	`cpe:/a:ibm:hardware_management_console:v10`	V10

CVE-2021-46766

Affected products

Known affected 15 products

Product	Identifier	Version
Lenovo BIOS Lenovo	`cpe:/h:lenovo:bios:-`	—
Dell Computer Dell	`cpe:/o:dell:dell_computer:-`	—
HP Computer HP / Computer	`cpe:/h:hp:computer:-`	—
Dell BIOS Dell / BIOS	`cpe:/h:dell:bios:-`	—
AMD Prozessor AMD / Prozessor	`cpe:/h:amd:amd_processor:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Dell BIOS Dell / BIOS	`cpe:/h:dell:bios:-`	—
HP Computer HP / Computer	`cpe:/h:hp:computer:-`	—
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
AMD Prozessor AMD / Prozessor	`cpe:/h:amd:amd_processor:-`	—
Lenovo Computer Lenovo	`cpe:/h:lenovo:computer:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Open Source CentOS Open Source	`cpe:/o:centos:centos:-`	—
HPE ProLiant HPE	`cpe:/h:hp:proliant:-`	—
IBM Power Hardware Management Console V10 IBM / Power Hardware Management Console	`cpe:/a:ibm:hardware_management_console:v10`	V10

CVE-2021-46774

Affected products

Known affected 15 products

Product	Identifier	Version
Lenovo BIOS Lenovo	`cpe:/h:lenovo:bios:-`	—
Dell Computer Dell	`cpe:/o:dell:dell_computer:-`	—
HP Computer HP / Computer	`cpe:/h:hp:computer:-`	—
Dell BIOS Dell / BIOS	`cpe:/h:dell:bios:-`	—
AMD Prozessor AMD / Prozessor	`cpe:/h:amd:amd_processor:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Dell BIOS Dell / BIOS	`cpe:/h:dell:bios:-`	—
HP Computer HP / Computer	`cpe:/h:hp:computer:-`	—
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
AMD Prozessor AMD / Prozessor	`cpe:/h:amd:amd_processor:-`	—
Lenovo Computer Lenovo	`cpe:/h:lenovo:computer:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Open Source CentOS Open Source	`cpe:/o:centos:centos:-`	—
HPE ProLiant HPE	`cpe:/h:hp:proliant:-`	—
IBM Power Hardware Management Console V10 IBM / Power Hardware Management Console	`cpe:/a:ibm:hardware_management_console:v10`	V10

CVE-2022-23820

Affected products

Known affected 15 products

Product	Identifier	Version
Lenovo BIOS Lenovo	`cpe:/h:lenovo:bios:-`	—
Dell Computer Dell	`cpe:/o:dell:dell_computer:-`	—
HP Computer HP / Computer	`cpe:/h:hp:computer:-`	—
Dell BIOS Dell / BIOS	`cpe:/h:dell:bios:-`	—
AMD Prozessor AMD / Prozessor	`cpe:/h:amd:amd_processor:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Dell BIOS Dell / BIOS	`cpe:/h:dell:bios:-`	—
HP Computer HP / Computer	`cpe:/h:hp:computer:-`	—
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
AMD Prozessor AMD / Prozessor	`cpe:/h:amd:amd_processor:-`	—
Lenovo Computer Lenovo	`cpe:/h:lenovo:computer:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Open Source CentOS Open Source	`cpe:/o:centos:centos:-`	—
HPE ProLiant HPE	`cpe:/h:hp:proliant:-`	—
IBM Power Hardware Management Console V10 IBM / Power Hardware Management Console	`cpe:/a:ibm:hardware_management_console:v10`	V10

CVE-2022-23821

Affected products

Known affected 15 products

Product	Identifier	Version
Lenovo BIOS Lenovo	`cpe:/h:lenovo:bios:-`	—
Dell Computer Dell	`cpe:/o:dell:dell_computer:-`	—
HP Computer HP / Computer	`cpe:/h:hp:computer:-`	—
Dell BIOS Dell / BIOS	`cpe:/h:dell:bios:-`	—
AMD Prozessor AMD / Prozessor	`cpe:/h:amd:amd_processor:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Dell BIOS Dell / BIOS	`cpe:/h:dell:bios:-`	—
HP Computer HP / Computer	`cpe:/h:hp:computer:-`	—
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
AMD Prozessor AMD / Prozessor	`cpe:/h:amd:amd_processor:-`	—
Lenovo Computer Lenovo	`cpe:/h:lenovo:computer:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Open Source CentOS Open Source	`cpe:/o:centos:centos:-`	—
HPE ProLiant HPE	`cpe:/h:hp:proliant:-`	—
IBM Power Hardware Management Console V10 IBM / Power Hardware Management Console	`cpe:/a:ibm:hardware_management_console:v10`	V10

CVE-2022-23830

Affected products

Known affected 15 products

Product	Identifier	Version
Lenovo BIOS Lenovo	`cpe:/h:lenovo:bios:-`	—
Dell Computer Dell	`cpe:/o:dell:dell_computer:-`	—
HP Computer HP / Computer	`cpe:/h:hp:computer:-`	—
Dell BIOS Dell / BIOS	`cpe:/h:dell:bios:-`	—
AMD Prozessor AMD / Prozessor	`cpe:/h:amd:amd_processor:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Dell BIOS Dell / BIOS	`cpe:/h:dell:bios:-`	—
HP Computer HP / Computer	`cpe:/h:hp:computer:-`	—
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
AMD Prozessor AMD / Prozessor	`cpe:/h:amd:amd_processor:-`	—
Lenovo Computer Lenovo	`cpe:/h:lenovo:computer:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Open Source CentOS Open Source	`cpe:/o:centos:centos:-`	—
HPE ProLiant HPE	`cpe:/h:hp:proliant:-`	—
IBM Power Hardware Management Console V10 IBM / Power Hardware Management Console	`cpe:/a:ibm:hardware_management_console:v10`	V10

CVE-2023-20519

Affected products

Known affected 15 products

Product	Identifier	Version
Lenovo BIOS Lenovo	`cpe:/h:lenovo:bios:-`	—
Dell Computer Dell	`cpe:/o:dell:dell_computer:-`	—
HP Computer HP / Computer	`cpe:/h:hp:computer:-`	—
Dell BIOS Dell / BIOS	`cpe:/h:dell:bios:-`	—
AMD Prozessor AMD / Prozessor	`cpe:/h:amd:amd_processor:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Dell BIOS Dell / BIOS	`cpe:/h:dell:bios:-`	—
HP Computer HP / Computer	`cpe:/h:hp:computer:-`	—
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
AMD Prozessor AMD / Prozessor	`cpe:/h:amd:amd_processor:-`	—
Lenovo Computer Lenovo	`cpe:/h:lenovo:computer:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Open Source CentOS Open Source	`cpe:/o:centos:centos:-`	—
HPE ProLiant HPE	`cpe:/h:hp:proliant:-`	—
IBM Power Hardware Management Console V10 IBM / Power Hardware Management Console	`cpe:/a:ibm:hardware_management_console:v10`	V10

CVE-2023-20521

Affected products

Known affected 15 products

Product	Identifier	Version
Lenovo BIOS Lenovo	`cpe:/h:lenovo:bios:-`	—
Dell Computer Dell	`cpe:/o:dell:dell_computer:-`	—
HP Computer HP / Computer	`cpe:/h:hp:computer:-`	—
Dell BIOS Dell / BIOS	`cpe:/h:dell:bios:-`	—
AMD Prozessor AMD / Prozessor	`cpe:/h:amd:amd_processor:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Dell BIOS Dell / BIOS	`cpe:/h:dell:bios:-`	—
HP Computer HP / Computer	`cpe:/h:hp:computer:-`	—
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
AMD Prozessor AMD / Prozessor	`cpe:/h:amd:amd_processor:-`	—
Lenovo Computer Lenovo	`cpe:/h:lenovo:computer:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Open Source CentOS Open Source	`cpe:/o:centos:centos:-`	—
HPE ProLiant HPE	`cpe:/h:hp:proliant:-`	—
IBM Power Hardware Management Console V10 IBM / Power Hardware Management Console	`cpe:/a:ibm:hardware_management_console:v10`	V10

CVE-2023-20526

Affected products

Known affected 15 products

Product	Identifier	Version
Lenovo BIOS Lenovo	`cpe:/h:lenovo:bios:-`	—
Dell Computer Dell	`cpe:/o:dell:dell_computer:-`	—
HP Computer HP / Computer	`cpe:/h:hp:computer:-`	—
Dell BIOS Dell / BIOS	`cpe:/h:dell:bios:-`	—
AMD Prozessor AMD / Prozessor	`cpe:/h:amd:amd_processor:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Dell BIOS Dell / BIOS	`cpe:/h:dell:bios:-`	—
HP Computer HP / Computer	`cpe:/h:hp:computer:-`	—
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
AMD Prozessor AMD / Prozessor	`cpe:/h:amd:amd_processor:-`	—
Lenovo Computer Lenovo	`cpe:/h:lenovo:computer:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Open Source CentOS Open Source	`cpe:/o:centos:centos:-`	—
HPE ProLiant HPE	`cpe:/h:hp:proliant:-`	—
IBM Power Hardware Management Console V10 IBM / Power Hardware Management Console	`cpe:/a:ibm:hardware_management_console:v10`	V10

CVE-2023-20533

Affected products

Known affected 15 products

Product	Identifier	Version
Lenovo BIOS Lenovo	`cpe:/h:lenovo:bios:-`	—
Dell Computer Dell	`cpe:/o:dell:dell_computer:-`	—
HP Computer HP / Computer	`cpe:/h:hp:computer:-`	—
Dell BIOS Dell / BIOS	`cpe:/h:dell:bios:-`	—
AMD Prozessor AMD / Prozessor	`cpe:/h:amd:amd_processor:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Dell BIOS Dell / BIOS	`cpe:/h:dell:bios:-`	—
HP Computer HP / Computer	`cpe:/h:hp:computer:-`	—
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
AMD Prozessor AMD / Prozessor	`cpe:/h:amd:amd_processor:-`	—
Lenovo Computer Lenovo	`cpe:/h:lenovo:computer:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Open Source CentOS Open Source	`cpe:/o:centos:centos:-`	—
HPE ProLiant HPE	`cpe:/h:hp:proliant:-`	—
IBM Power Hardware Management Console V10 IBM / Power Hardware Management Console	`cpe:/a:ibm:hardware_management_console:v10`	V10

CVE-2023-20563

Affected products

Known affected 15 products

Product	Identifier	Version
Lenovo BIOS Lenovo	`cpe:/h:lenovo:bios:-`	—
Dell Computer Dell	`cpe:/o:dell:dell_computer:-`	—
HP Computer HP / Computer	`cpe:/h:hp:computer:-`	—
Dell BIOS Dell / BIOS	`cpe:/h:dell:bios:-`	—
AMD Prozessor AMD / Prozessor	`cpe:/h:amd:amd_processor:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Dell BIOS Dell / BIOS	`cpe:/h:dell:bios:-`	—
HP Computer HP / Computer	`cpe:/h:hp:computer:-`	—
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
AMD Prozessor AMD / Prozessor	`cpe:/h:amd:amd_processor:-`	—
Lenovo Computer Lenovo	`cpe:/h:lenovo:computer:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Open Source CentOS Open Source	`cpe:/o:centos:centos:-`	—
HPE ProLiant HPE	`cpe:/h:hp:proliant:-`	—
IBM Power Hardware Management Console V10 IBM / Power Hardware Management Console	`cpe:/a:ibm:hardware_management_console:v10`	V10

CVE-2023-20565

Affected products

Known affected 15 products

Product	Identifier	Version
Lenovo BIOS Lenovo	`cpe:/h:lenovo:bios:-`	—
Dell Computer Dell	`cpe:/o:dell:dell_computer:-`	—
HP Computer HP / Computer	`cpe:/h:hp:computer:-`	—
Dell BIOS Dell / BIOS	`cpe:/h:dell:bios:-`	—
AMD Prozessor AMD / Prozessor	`cpe:/h:amd:amd_processor:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Dell BIOS Dell / BIOS	`cpe:/h:dell:bios:-`	—
HP Computer HP / Computer	`cpe:/h:hp:computer:-`	—
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
AMD Prozessor AMD / Prozessor	`cpe:/h:amd:amd_processor:-`	—
Lenovo Computer Lenovo	`cpe:/h:lenovo:computer:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Open Source CentOS Open Source	`cpe:/o:centos:centos:-`	—
HPE ProLiant HPE	`cpe:/h:hp:proliant:-`	—
IBM Power Hardware Management Console V10 IBM / Power Hardware Management Console	`cpe:/a:ibm:hardware_management_console:v10`	V10

CVE-2023-20566

Affected products

Known affected 15 products

Product	Identifier	Version
Lenovo BIOS Lenovo	`cpe:/h:lenovo:bios:-`	—
Dell Computer Dell	`cpe:/o:dell:dell_computer:-`	—
HP Computer HP / Computer	`cpe:/h:hp:computer:-`	—
Dell BIOS Dell / BIOS	`cpe:/h:dell:bios:-`	—
AMD Prozessor AMD / Prozessor	`cpe:/h:amd:amd_processor:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Dell BIOS Dell / BIOS	`cpe:/h:dell:bios:-`	—
HP Computer HP / Computer	`cpe:/h:hp:computer:-`	—
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
AMD Prozessor AMD / Prozessor	`cpe:/h:amd:amd_processor:-`	—
Lenovo Computer Lenovo	`cpe:/h:lenovo:computer:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Open Source CentOS Open Source	`cpe:/o:centos:centos:-`	—
HPE ProLiant HPE	`cpe:/h:hp:proliant:-`	—
IBM Power Hardware Management Console V10 IBM / Power Hardware Management Console	`cpe:/a:ibm:hardware_management_console:v10`	V10

CVE-2023-20571

Affected products

Known affected 15 products

Product	Identifier	Version
Lenovo BIOS Lenovo	`cpe:/h:lenovo:bios:-`	—
Dell Computer Dell	`cpe:/o:dell:dell_computer:-`	—
HP Computer HP / Computer	`cpe:/h:hp:computer:-`	—
Dell BIOS Dell / BIOS	`cpe:/h:dell:bios:-`	—
AMD Prozessor AMD / Prozessor	`cpe:/h:amd:amd_processor:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Dell BIOS Dell / BIOS	`cpe:/h:dell:bios:-`	—
HP Computer HP / Computer	`cpe:/h:hp:computer:-`	—
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
AMD Prozessor AMD / Prozessor	`cpe:/h:amd:amd_processor:-`	—
Lenovo Computer Lenovo	`cpe:/h:lenovo:computer:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Open Source CentOS Open Source	`cpe:/o:centos:centos:-`	—
HPE ProLiant HPE	`cpe:/h:hp:proliant:-`	—
IBM Power Hardware Management Console V10 IBM / Power Hardware Management Console	`cpe:/a:ibm:hardware_management_console:v10`	V10

CVE-2023-20592

Es besteht eine Schwachstelle in AMD-Prozessoren. Dieser Fehler besteht aufgrund eines unsachgemäßen oder unerwarteten Verhaltens des INVD-Befehls, der es ermöglicht, das Cache-Zeilen-Rückschreibverhalten der CPU zu beeinflussen. Ein Angreifer mit einem bösartigen Hypervisor kann diese Schwachstelle ausnutzen, um vertrauliche Informationen offenzulegen.

Affected products

Known affected 15 products

Product	Identifier	Version
Lenovo BIOS Lenovo	`cpe:/h:lenovo:bios:-`	—
Dell Computer Dell	`cpe:/o:dell:dell_computer:-`	—
HP Computer HP / Computer	`cpe:/h:hp:computer:-`	—
Dell BIOS Dell / BIOS	`cpe:/h:dell:bios:-`	—
AMD Prozessor AMD / Prozessor	`cpe:/h:amd:amd_processor:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Dell BIOS Dell / BIOS	`cpe:/h:dell:bios:-`	—
HP Computer HP / Computer	`cpe:/h:hp:computer:-`	—
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
AMD Prozessor AMD / Prozessor	`cpe:/h:amd:amd_processor:-`	—
Lenovo Computer Lenovo	`cpe:/h:lenovo:computer:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Open Source CentOS Open Source	`cpe:/o:centos:centos:-`	—
HPE ProLiant HPE	`cpe:/h:hp:proliant:-`	—
IBM Power Hardware Management Console V10 IBM / Power Hardware Management Console	`cpe:/a:ibm:hardware_management_console:v10`	V10

CVE-2023-20596

Es besteht eine Schwachstelle in AMD-Prozessoren. Dieser Fehler besteht aufgrund einer unsachgemäßen Eingabevalidierung im SMM Supervisor, die es ermöglicht, Ring0-Zugriff zu erlangen. Ein Angreifer mit einem kompromittierten SMI-Handler kann diese Schwachstelle zur Ausführung von beliebigem Code ausnutzen.

Affected products

Known affected 15 products

Product	Identifier	Version
Lenovo BIOS Lenovo	`cpe:/h:lenovo:bios:-`	—
Dell Computer Dell	`cpe:/o:dell:dell_computer:-`	—
HP Computer HP / Computer	`cpe:/h:hp:computer:-`	—
Dell BIOS Dell / BIOS	`cpe:/h:dell:bios:-`	—
AMD Prozessor AMD / Prozessor	`cpe:/h:amd:amd_processor:-`	—
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Dell BIOS Dell / BIOS	`cpe:/h:dell:bios:-`	—
HP Computer HP / Computer	`cpe:/h:hp:computer:-`	—
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
AMD Prozessor AMD / Prozessor	`cpe:/h:amd:amd_processor:-`	—
Lenovo Computer Lenovo	`cpe:/h:lenovo:computer:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Open Source CentOS Open Source	`cpe:/o:centos:centos:-`	—
HPE ProLiant HPE	`cpe:/h:hp:proliant:-`	—
IBM Power Hardware Management Console V10 IBM / Power Hardware Management Console	`cpe:/a:ibm:hardware_management_console:v10`	V10

References

32 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://www.amd.com/en/resources/product-security…	external
https://www.amd.com/en/resources/product-security…	external
https://www.amd.com/en/resources/product-security…	external
https://www.amd.com/en/resources/product-security…	external
https://support.lenovo.com/de/de/product_security…	external
https://lists.suse.com/pipermail/sle-security-upd…	external
https://www.dell.com/support/kbdoc/000220057/dsa-2023-=	external
https://www.dell.com/support/kbdoc/000220223/dsa-2023-=	external
https://www.dell.com/support/kbdoc/000220054/dsa-2023-=	external
https://support.hp.com/us-en/document/ish_9799938…	external
https://www.dell.com/support/kbdoc/000218423/dsa-2023-=	external
https://lists.suse.com/pipermail/sle-security-upd…	external
https://lists.suse.com/pipermail/sle-security-upd…	external
https://lists.suse.com/pipermail/sle-security-upd…	external
https://lists.suse.com/pipermail/sle-security-upd…	external
https://support.hp.com/us-en/document/ish_9925738…	external
https://access.redhat.com/errata/RHSA-2024:0753	external
https://www.amd.com/en/resources/product-security…	external
https://lists.centos.org/pipermail/centos-announc…	external
https://access.redhat.com/errata/RHSA-2024:0979	external
https://access.redhat.com/errata/RHSA-2024:0978	external
https://access.redhat.com/errata/RHSA-2024:1112	external
https://www.dell.com/support/kbdoc/000217573/dsa-2023-=	external
https://access.redhat.com/errata/RHSA-2024:3178	external
https://linux.oracle.com/errata/ELSA-2024-3178.html	external
https://support.hpe.com/hpesc/public/docDisplay?d…	external
https://lists.suse.com/pipermail/sle-security-upd…	external
https://access.redhat.com/errata/RHSA-2024:4575	external
https://www.ibm.com/support/pages/node/7173420	external
https://www.ibm.com/support/pages/node/7178944	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Prozessoren sind die zentralen Rechenwerke eines Computers.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein lokaler Angreifer kann mehrere Schwachstellen in AMD Prozessor ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand zu verursachen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen oder seine Privilegien zu erweitern.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- BIOS/Firmware",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2023-2916 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-2916.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2023-2916 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-2916"
      },
      {
        "category": "external",
        "summary": "AMD Security Bulletin vom 2023-11-14",
        "url": "https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3002.html"
      },
      {
        "category": "external",
        "summary": "AMD Security Bulletin vom 2023-11-14",
        "url": "https://www.amd.com/en/resources/product-security/bulletin/amd-sb-4002.html"
      },
      {
        "category": "external",
        "summary": "AMD Security Bulletin vom 2023-11-14",
        "url": "https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3005.html"
      },
      {
        "category": "external",
        "summary": "AMD Security Bulletin vom 2023-11-14",
        "url": "https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7011.html"
      },
      {
        "category": "external",
        "summary": "Lenovo Multi-vendor BIOS Security Vulnerabilities",
        "url": "https://support.lenovo.com/de/de/product_security/ps500589-multi-vendor-bios-security-vulnerabilities-november-2023"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2023:4654-1 vom 2023-12-06",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-December/017285.html"
      },
      {
        "category": "external",
        "summary": "Dell Security Advisory DSA-2023-442 vom 2023-12-07",
        "url": "https://www.dell.com/support/kbdoc/000220057/dsa-2023-="
      },
      {
        "category": "external",
        "summary": "Dell Security Advisory DSA-2023-457 vom 2023-12-07",
        "url": "https://www.dell.com/support/kbdoc/000220223/dsa-2023-="
      },
      {
        "category": "external",
        "summary": "Dell Security Advisory DSA-2023-441 vom 2023-12-07",
        "url": "https://www.dell.com/support/kbdoc/000220054/dsa-2023-="
      },
      {
        "category": "external",
        "summary": "HP Security Bulletin HPSBHF03893 vom 2023-12-08",
        "url": "https://support.hp.com/us-en/document/ish_9799938-9799975-16/HPSBHF03893"
      },
      {
        "category": "external",
        "summary": "Dell Security Advisory DSA-2023-386 vom 2023-12-13",
        "url": "https://www.dell.com/support/kbdoc/000218423/dsa-2023-="
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2023:4665-1 vom 2023-12-14",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-December/017397.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2023:4655-1 vom 2023-12-14",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-December/017401.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2023:4664-1 vom 2023-12-14",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-December/017396.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2023:4660-1 vom 2023-12-14",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-December/017402.html"
      },
      {
        "category": "external",
        "summary": "HP Security Bulletin HPSBHF03892 vom 2024-01-08",
        "url": "https://support.hp.com/us-en/document/ish_9925738-9925742-16/HPSBHF03892"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:0753 vom 2024-02-08",
        "url": "https://access.redhat.com/errata/RHSA-2024:0753"
      },
      {
        "category": "external",
        "summary": "AMD Security Bulletin",
        "url": "https://www.amd.com/en/resources/product-security/bulletin/amd-sb-5001.html"
      },
      {
        "category": "external",
        "summary": "CentOS Security Advisory CESA-2024:0753 vom 2024-02-20",
        "url": "https://lists.centos.org/pipermail/centos-announce/2024-February/099225.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:0979 vom 2024-02-26",
        "url": "https://access.redhat.com/errata/RHSA-2024:0979"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:0978 vom 2024-02-26",
        "url": "https://access.redhat.com/errata/RHSA-2024:0978"
      },
      {
        "category": "external",
        "summary": "RedHat Security Advisory",
        "url": "https://access.redhat.com/errata/RHSA-2024:1112"
      },
      {
        "category": "external",
        "summary": "Dell Security Advisory DSA-2023-332 vom 2024-05-01",
        "url": "https://www.dell.com/support/kbdoc/000217573/dsa-2023-="
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:3178 vom 2024-05-22",
        "url": "https://access.redhat.com/errata/RHSA-2024:3178"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2024-3178 vom 2024-05-28",
        "url": "https://linux.oracle.com/errata/ELSA-2024-3178.html"
      },
      {
        "category": "external",
        "summary": "HPE SECURITY BULLETIN HPESBCR04657 vom 2024-06-27",
        "url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbcr04657en_us\u0026docLocale=en_US"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2024:2376-1 vom 2024-07-09",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2024-July/018914.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:4575 vom 2024-07-17",
        "url": "https://access.redhat.com/errata/RHSA-2024:4575"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7173420 vom 2024-10-17",
        "url": "https://www.ibm.com/support/pages/node/7173420"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7178944 vom 2024-12-14",
        "url": "https://www.ibm.com/support/pages/node/7178944"
      }
    ],
    "source_lang": "en-US",
    "title": "AMD Prozessor: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2024-12-15T23:00:00.000+00:00",
      "generator": {
        "date": "2024-12-16T09:17:43.897+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.10"
        }
      },
      "id": "WID-SEC-W-2023-2916",
      "initial_release_date": "2023-11-14T23:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2023-11-14T23:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2023-12-06T23:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von SUSE und Dell aufgenommen"
        },
        {
          "date": "2023-12-07T23:00:00.000+00:00",
          "number": "3",
          "summary": "Neue Updates von HP aufgenommen"
        },
        {
          "date": "2023-12-12T23:00:00.000+00:00",
          "number": "4",
          "summary": "Neue Updates von Dell aufgenommen"
        },
        {
          "date": "2023-12-14T23:00:00.000+00:00",
          "number": "5",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2024-01-07T23:00:00.000+00:00",
          "number": "6",
          "summary": "Neue Updates von HP aufgenommen"
        },
        {
          "date": "2024-02-08T23:00:00.000+00:00",
          "number": "7",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2024-02-13T23:00:00.000+00:00",
          "number": "8",
          "summary": "Neue Updates von AMD aufgenommen"
        },
        {
          "date": "2024-02-20T23:00:00.000+00:00",
          "number": "9",
          "summary": "Neue Updates von CentOS aufgenommen"
        },
        {
          "date": "2024-02-25T23:00:00.000+00:00",
          "number": "10",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2024-03-05T23:00:00.000+00:00",
          "number": "11",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2024-05-01T22:00:00.000+00:00",
          "number": "12",
          "summary": "Neue Updates von Dell aufgenommen"
        },
        {
          "date": "2024-05-21T22:00:00.000+00:00",
          "number": "13",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2024-05-28T22:00:00.000+00:00",
          "number": "14",
          "summary": "Neue Updates von Oracle Linux aufgenommen"
        },
        {
          "date": "2024-06-27T22:00:00.000+00:00",
          "number": "15",
          "summary": "Neue Updates von HP aufgenommen"
        },
        {
          "date": "2024-07-09T22:00:00.000+00:00",
          "number": "16",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2024-07-16T22:00:00.000+00:00",
          "number": "17",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2024-10-17T22:00:00.000+00:00",
          "number": "18",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2024-12-15T23:00:00.000+00:00",
          "number": "19",
          "summary": "Neue Updates von IBM aufgenommen"
        }
      ],
      "status": "final",
      "version": "19"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "AMD Prozessor",
                "product": {
                  "name": "AMD Prozessor",
                  "product_id": "T029010",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:amd:amd_processor:-"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "AMD Prozessor",
                "product": {
                  "name": "AMD Prozessor",
                  "product_id": "T031175",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:amd:amd_processor:-"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Prozessor"
          }
        ],
        "category": "vendor",
        "name": "AMD"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Dell BIOS",
                "product": {
                  "name": "Dell BIOS",
                  "product_id": "T029364",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:dell:bios:-"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Dell BIOS",
                "product": {
                  "name": "Dell BIOS",
                  "product_id": "T032778",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:dell:bios:-"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "BIOS"
          },
          {
            "category": "product_name",
            "name": "Dell Computer",
            "product": {
              "name": "Dell Computer",
              "product_id": "T006498",
              "product_identification_helper": {
                "cpe": "cpe:/o:dell:dell_computer:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Dell"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "HP Computer",
                "product": {
                  "name": "HP Computer",
                  "product_id": "T023191",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:hp:computer:-"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "HP Computer",
                "product": {
                  "name": "HP Computer",
                  "product_id": "T031292",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:hp:computer:-"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Computer"
          }
        ],
        "category": "vendor",
        "name": "HP"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "HPE ProLiant",
            "product": {
              "name": "HPE ProLiant",
              "product_id": "T009310",
              "product_identification_helper": {
                "cpe": "cpe:/h:hp:proliant:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "HPE"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "V10",
                "product": {
                  "name": "IBM Power Hardware Management Console V10",
                  "product_id": "T023373",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:hardware_management_console:v10"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Power Hardware Management Console"
          }
        ],
        "category": "vendor",
        "name": "IBM"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Lenovo BIOS",
            "product": {
              "name": "Lenovo BIOS",
              "product_id": "T005651",
              "product_identification_helper": {
                "cpe": "cpe:/h:lenovo:bios:-"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Lenovo Computer",
            "product": {
              "name": "Lenovo Computer",
              "product_id": "T030470",
              "product_identification_helper": {
                "cpe": "cpe:/h:lenovo:computer:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Lenovo"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Open Source CentOS",
            "product": {
              "name": "Open Source CentOS",
              "product_id": "1727",
              "product_identification_helper": {
                "cpe": "cpe:/o:centos:centos:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Open Source"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Oracle Linux",
            "product": {
              "name": "Oracle Linux",
              "product_id": "T004914",
              "product_identification_helper": {
                "cpe": "cpe:/o:oracle:linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Oracle"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Red Hat Enterprise Linux",
            "product": {
              "name": "Red Hat Enterprise Linux",
              "product_id": "67646",
              "product_identification_helper": {
                "cpe": "cpe:/o:redhat:enterprise_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "SUSE Linux",
            "product": {
              "name": "SUSE Linux",
              "product_id": "T002207",
              "product_identification_helper": {
                "cpe": "cpe:/o:suse:suse_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-26345",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in AMD Prozessor. Diese Fehler bestehen im AMD Secure Processor (ASP), AMD System Management Unit (SMU), AMD Secure Encrypted Virtualization (SEV), AMD Secure Encrypted Virtualization - Secure Nested Paging (SEV-SNP) und anderen Plattformkomponenten aufgrund verschiedener Sicherheitsprobleme wie einer unzureichenden Eingabevalidierung, einem \"Use-After-Free\", einer unsachgem\u00e4\u00dfen Adressvalidierung und anderen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand zu verursachen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen oder seine Privilegien zu erweitern."
        }
      ],
      "product_status": {
        "known_affected": [
          "T005651",
          "T006498",
          "T023191",
          "T029364",
          "T029010",
          "67646",
          "T032778",
          "T031292",
          "T004914",
          "T031175",
          "T030470",
          "T002207",
          "1727",
          "T009310",
          "T023373"
        ]
      },
      "release_date": "2023-11-14T23:00:00.000+00:00",
      "title": "CVE-2021-26345"
    },
    {
      "cve": "CVE-2021-46758",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in AMD Prozessor. Diese Fehler bestehen im AMD Secure Processor (ASP), AMD System Management Unit (SMU), AMD Secure Encrypted Virtualization (SEV), AMD Secure Encrypted Virtualization - Secure Nested Paging (SEV-SNP) und anderen Plattformkomponenten aufgrund verschiedener Sicherheitsprobleme wie einer unzureichenden Eingabevalidierung, einem \"Use-After-Free\", einer unsachgem\u00e4\u00dfen Adressvalidierung und anderen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand zu verursachen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen oder seine Privilegien zu erweitern."
        }
      ],
      "product_status": {
        "known_affected": [
          "T005651",
          "T006498",
          "T023191",
          "T029364",
          "T029010",
          "67646",
          "T032778",
          "T031292",
          "T004914",
          "T031175",
          "T030470",
          "T002207",
          "1727",
          "T009310",
          "T023373"
        ]
      },
      "release_date": "2023-11-14T23:00:00.000+00:00",
      "title": "CVE-2021-46758"
    },
    {
      "cve": "CVE-2021-46766",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in AMD Prozessor. Diese Fehler bestehen im AMD Secure Processor (ASP), AMD System Management Unit (SMU), AMD Secure Encrypted Virtualization (SEV), AMD Secure Encrypted Virtualization - Secure Nested Paging (SEV-SNP) und anderen Plattformkomponenten aufgrund verschiedener Sicherheitsprobleme wie einer unzureichenden Eingabevalidierung, einem \"Use-After-Free\", einer unsachgem\u00e4\u00dfen Adressvalidierung und anderen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand zu verursachen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen oder seine Privilegien zu erweitern."
        }
      ],
      "product_status": {
        "known_affected": [
          "T005651",
          "T006498",
          "T023191",
          "T029364",
          "T029010",
          "67646",
          "T032778",
          "T031292",
          "T004914",
          "T031175",
          "T030470",
          "T002207",
          "1727",
          "T009310",
          "T023373"
        ]
      },
      "release_date": "2023-11-14T23:00:00.000+00:00",
      "title": "CVE-2021-46766"
    },
    {
      "cve": "CVE-2021-46774",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in AMD Prozessor. Diese Fehler bestehen im AMD Secure Processor (ASP), AMD System Management Unit (SMU), AMD Secure Encrypted Virtualization (SEV), AMD Secure Encrypted Virtualization - Secure Nested Paging (SEV-SNP) und anderen Plattformkomponenten aufgrund verschiedener Sicherheitsprobleme wie einer unzureichenden Eingabevalidierung, einem \"Use-After-Free\", einer unsachgem\u00e4\u00dfen Adressvalidierung und anderen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand zu verursachen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen oder seine Privilegien zu erweitern."
        }
      ],
      "product_status": {
        "known_affected": [
          "T005651",
          "T006498",
          "T023191",
          "T029364",
          "T029010",
          "67646",
          "T032778",
          "T031292",
          "T004914",
          "T031175",
          "T030470",
          "T002207",
          "1727",
          "T009310",
          "T023373"
        ]
      },
      "release_date": "2023-11-14T23:00:00.000+00:00",
      "title": "CVE-2021-46774"
    },
    {
      "cve": "CVE-2022-23820",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in AMD Prozessor. Diese Fehler bestehen im AMD Secure Processor (ASP), AMD System Management Unit (SMU), AMD Secure Encrypted Virtualization (SEV), AMD Secure Encrypted Virtualization - Secure Nested Paging (SEV-SNP) und anderen Plattformkomponenten aufgrund verschiedener Sicherheitsprobleme wie einer unzureichenden Eingabevalidierung, einem \"Use-After-Free\", einer unsachgem\u00e4\u00dfen Adressvalidierung und anderen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand zu verursachen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen oder seine Privilegien zu erweitern."
        }
      ],
      "product_status": {
        "known_affected": [
          "T005651",
          "T006498",
          "T023191",
          "T029364",
          "T029010",
          "67646",
          "T032778",
          "T031292",
          "T004914",
          "T031175",
          "T030470",
          "T002207",
          "1727",
          "T009310",
          "T023373"
        ]
      },
      "release_date": "2023-11-14T23:00:00.000+00:00",
      "title": "CVE-2022-23820"
    },
    {
      "cve": "CVE-2022-23821",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in AMD Prozessor. Diese Fehler bestehen im AMD Secure Processor (ASP), AMD System Management Unit (SMU), AMD Secure Encrypted Virtualization (SEV), AMD Secure Encrypted Virtualization - Secure Nested Paging (SEV-SNP) und anderen Plattformkomponenten aufgrund verschiedener Sicherheitsprobleme wie einer unzureichenden Eingabevalidierung, einem \"Use-After-Free\", einer unsachgem\u00e4\u00dfen Adressvalidierung und anderen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand zu verursachen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen oder seine Privilegien zu erweitern."
        }
      ],
      "product_status": {
        "known_affected": [
          "T005651",
          "T006498",
          "T023191",
          "T029364",
          "T029010",
          "67646",
          "T032778",
          "T031292",
          "T004914",
          "T031175",
          "T030470",
          "T002207",
          "1727",
          "T009310",
          "T023373"
        ]
      },
      "release_date": "2023-11-14T23:00:00.000+00:00",
      "title": "CVE-2022-23821"
    },
    {
      "cve": "CVE-2022-23830",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in AMD Prozessor. Diese Fehler bestehen im AMD Secure Processor (ASP), AMD System Management Unit (SMU), AMD Secure Encrypted Virtualization (SEV), AMD Secure Encrypted Virtualization - Secure Nested Paging (SEV-SNP) und anderen Plattformkomponenten aufgrund verschiedener Sicherheitsprobleme wie einer unzureichenden Eingabevalidierung, einem \"Use-After-Free\", einer unsachgem\u00e4\u00dfen Adressvalidierung und anderen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand zu verursachen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen oder seine Privilegien zu erweitern."
        }
      ],
      "product_status": {
        "known_affected": [
          "T005651",
          "T006498",
          "T023191",
          "T029364",
          "T029010",
          "67646",
          "T032778",
          "T031292",
          "T004914",
          "T031175",
          "T030470",
          "T002207",
          "1727",
          "T009310",
          "T023373"
        ]
      },
      "release_date": "2023-11-14T23:00:00.000+00:00",
      "title": "CVE-2022-23830"
    },
    {
      "cve": "CVE-2023-20519",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in AMD Prozessor. Diese Fehler bestehen im AMD Secure Processor (ASP), AMD System Management Unit (SMU), AMD Secure Encrypted Virtualization (SEV), AMD Secure Encrypted Virtualization - Secure Nested Paging (SEV-SNP) und anderen Plattformkomponenten aufgrund verschiedener Sicherheitsprobleme wie einer unzureichenden Eingabevalidierung, einem \"Use-After-Free\", einer unsachgem\u00e4\u00dfen Adressvalidierung und anderen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand zu verursachen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen oder seine Privilegien zu erweitern."
        }
      ],
      "product_status": {
        "known_affected": [
          "T005651",
          "T006498",
          "T023191",
          "T029364",
          "T029010",
          "67646",
          "T032778",
          "T031292",
          "T004914",
          "T031175",
          "T030470",
          "T002207",
          "1727",
          "T009310",
          "T023373"
        ]
      },
      "release_date": "2023-11-14T23:00:00.000+00:00",
      "title": "CVE-2023-20519"
    },
    {
      "cve": "CVE-2023-20521",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in AMD Prozessor. Diese Fehler bestehen im AMD Secure Processor (ASP), AMD System Management Unit (SMU), AMD Secure Encrypted Virtualization (SEV), AMD Secure Encrypted Virtualization - Secure Nested Paging (SEV-SNP) und anderen Plattformkomponenten aufgrund verschiedener Sicherheitsprobleme wie einer unzureichenden Eingabevalidierung, einem \"Use-After-Free\", einer unsachgem\u00e4\u00dfen Adressvalidierung und anderen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand zu verursachen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen oder seine Privilegien zu erweitern."
        }
      ],
      "product_status": {
        "known_affected": [
          "T005651",
          "T006498",
          "T023191",
          "T029364",
          "T029010",
          "67646",
          "T032778",
          "T031292",
          "T004914",
          "T031175",
          "T030470",
          "T002207",
          "1727",
          "T009310",
          "T023373"
        ]
      },
      "release_date": "2023-11-14T23:00:00.000+00:00",
      "title": "CVE-2023-20521"
    },
    {
      "cve": "CVE-2023-20526",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in AMD Prozessor. Diese Fehler bestehen im AMD Secure Processor (ASP), AMD System Management Unit (SMU), AMD Secure Encrypted Virtualization (SEV), AMD Secure Encrypted Virtualization - Secure Nested Paging (SEV-SNP) und anderen Plattformkomponenten aufgrund verschiedener Sicherheitsprobleme wie einer unzureichenden Eingabevalidierung, einem \"Use-After-Free\", einer unsachgem\u00e4\u00dfen Adressvalidierung und anderen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand zu verursachen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen oder seine Privilegien zu erweitern."
        }
      ],
      "product_status": {
        "known_affected": [
          "T005651",
          "T006498",
          "T023191",
          "T029364",
          "T029010",
          "67646",
          "T032778",
          "T031292",
          "T004914",
          "T031175",
          "T030470",
          "T002207",
          "1727",
          "T009310",
          "T023373"
        ]
      },
      "release_date": "2023-11-14T23:00:00.000+00:00",
      "title": "CVE-2023-20526"
    },
    {
      "cve": "CVE-2023-20533",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in AMD Prozessor. Diese Fehler bestehen im AMD Secure Processor (ASP), AMD System Management Unit (SMU), AMD Secure Encrypted Virtualization (SEV), AMD Secure Encrypted Virtualization - Secure Nested Paging (SEV-SNP) und anderen Plattformkomponenten aufgrund verschiedener Sicherheitsprobleme wie einer unzureichenden Eingabevalidierung, einem \"Use-After-Free\", einer unsachgem\u00e4\u00dfen Adressvalidierung und anderen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand zu verursachen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen oder seine Privilegien zu erweitern."
        }
      ],
      "product_status": {
        "known_affected": [
          "T005651",
          "T006498",
          "T023191",
          "T029364",
          "T029010",
          "67646",
          "T032778",
          "T031292",
          "T004914",
          "T031175",
          "T030470",
          "T002207",
          "1727",
          "T009310",
          "T023373"
        ]
      },
      "release_date": "2023-11-14T23:00:00.000+00:00",
      "title": "CVE-2023-20533"
    },
    {
      "cve": "CVE-2023-20563",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in AMD Prozessor. Diese Fehler bestehen im AMD Secure Processor (ASP), AMD System Management Unit (SMU), AMD Secure Encrypted Virtualization (SEV), AMD Secure Encrypted Virtualization - Secure Nested Paging (SEV-SNP) und anderen Plattformkomponenten aufgrund verschiedener Sicherheitsprobleme wie einer unzureichenden Eingabevalidierung, einem \"Use-After-Free\", einer unsachgem\u00e4\u00dfen Adressvalidierung und anderen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand zu verursachen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen oder seine Privilegien zu erweitern."
        }
      ],
      "product_status": {
        "known_affected": [
          "T005651",
          "T006498",
          "T023191",
          "T029364",
          "T029010",
          "67646",
          "T032778",
          "T031292",
          "T004914",
          "T031175",
          "T030470",
          "T002207",
          "1727",
          "T009310",
          "T023373"
        ]
      },
      "release_date": "2023-11-14T23:00:00.000+00:00",
      "title": "CVE-2023-20563"
    },
    {
      "cve": "CVE-2023-20565",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in AMD Prozessor. Diese Fehler bestehen im AMD Secure Processor (ASP), AMD System Management Unit (SMU), AMD Secure Encrypted Virtualization (SEV), AMD Secure Encrypted Virtualization - Secure Nested Paging (SEV-SNP) und anderen Plattformkomponenten aufgrund verschiedener Sicherheitsprobleme wie einer unzureichenden Eingabevalidierung, einem \"Use-After-Free\", einer unsachgem\u00e4\u00dfen Adressvalidierung und anderen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand zu verursachen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen oder seine Privilegien zu erweitern."
        }
      ],
      "product_status": {
        "known_affected": [
          "T005651",
          "T006498",
          "T023191",
          "T029364",
          "T029010",
          "67646",
          "T032778",
          "T031292",
          "T004914",
          "T031175",
          "T030470",
          "T002207",
          "1727",
          "T009310",
          "T023373"
        ]
      },
      "release_date": "2023-11-14T23:00:00.000+00:00",
      "title": "CVE-2023-20565"
    },
    {
      "cve": "CVE-2023-20566",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in AMD Prozessor. Diese Fehler bestehen im AMD Secure Processor (ASP), AMD System Management Unit (SMU), AMD Secure Encrypted Virtualization (SEV), AMD Secure Encrypted Virtualization - Secure Nested Paging (SEV-SNP) und anderen Plattformkomponenten aufgrund verschiedener Sicherheitsprobleme wie einer unzureichenden Eingabevalidierung, einem \"Use-After-Free\", einer unsachgem\u00e4\u00dfen Adressvalidierung und anderen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand zu verursachen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen oder seine Privilegien zu erweitern."
        }
      ],
      "product_status": {
        "known_affected": [
          "T005651",
          "T006498",
          "T023191",
          "T029364",
          "T029010",
          "67646",
          "T032778",
          "T031292",
          "T004914",
          "T031175",
          "T030470",
          "T002207",
          "1727",
          "T009310",
          "T023373"
        ]
      },
      "release_date": "2023-11-14T23:00:00.000+00:00",
      "title": "CVE-2023-20566"
    },
    {
      "cve": "CVE-2023-20571",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in AMD Prozessor. Diese Fehler bestehen im AMD Secure Processor (ASP), AMD System Management Unit (SMU), AMD Secure Encrypted Virtualization (SEV), AMD Secure Encrypted Virtualization - Secure Nested Paging (SEV-SNP) und anderen Plattformkomponenten aufgrund verschiedener Sicherheitsprobleme wie einer unzureichenden Eingabevalidierung, einem \"Use-After-Free\", einer unsachgem\u00e4\u00dfen Adressvalidierung und anderen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand zu verursachen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen oder seine Privilegien zu erweitern."
        }
      ],
      "product_status": {
        "known_affected": [
          "T005651",
          "T006498",
          "T023191",
          "T029364",
          "T029010",
          "67646",
          "T032778",
          "T031292",
          "T004914",
          "T031175",
          "T030470",
          "T002207",
          "1727",
          "T009310",
          "T023373"
        ]
      },
      "release_date": "2023-11-14T23:00:00.000+00:00",
      "title": "CVE-2023-20571"
    },
    {
      "cve": "CVE-2023-20592",
      "notes": [
        {
          "category": "description",
          "text": "Es besteht eine Schwachstelle in AMD-Prozessoren. Dieser Fehler besteht aufgrund eines unsachgem\u00e4\u00dfen oder unerwarteten Verhaltens des INVD-Befehls, der es erm\u00f6glicht, das Cache-Zeilen-R\u00fcckschreibverhalten der CPU zu beeinflussen. Ein Angreifer mit einem b\u00f6sartigen Hypervisor kann diese Schwachstelle ausnutzen, um vertrauliche Informationen offenzulegen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T005651",
          "T006498",
          "T023191",
          "T029364",
          "T029010",
          "67646",
          "T032778",
          "T031292",
          "T004914",
          "T031175",
          "T030470",
          "T002207",
          "1727",
          "T009310",
          "T023373"
        ]
      },
      "release_date": "2023-11-14T23:00:00.000+00:00",
      "title": "CVE-2023-20592"
    },
    {
      "cve": "CVE-2023-20596",
      "notes": [
        {
          "category": "description",
          "text": "Es besteht eine Schwachstelle in AMD-Prozessoren. Dieser Fehler besteht aufgrund einer unsachgem\u00e4\u00dfen Eingabevalidierung im SMM Supervisor, die es erm\u00f6glicht, Ring0-Zugriff zu erlangen. Ein Angreifer mit einem kompromittierten SMI-Handler kann diese Schwachstelle zur Ausf\u00fchrung von beliebigem Code ausnutzen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T005651",
          "T006498",
          "T023191",
          "T029364",
          "T029010",
          "67646",
          "T032778",
          "T031292",
          "T004914",
          "T031175",
          "T030470",
          "T002207",
          "1727",
          "T009310",
          "T023373"
        ]
      },
      "release_date": "2023-11-14T23:00:00.000+00:00",
      "title": "CVE-2023-20596"
    }
  ]
}

CVE-2021-26345 (GCVE-0-2021-26345)

Vulnerability from cvelistv5 – Published: 2023-11-14 18:53 – Updated: 2024-08-03 20:26

Summary

Failure to validate the value in APCB may allow a privileged attacker to tamper with the APCB token to force an out-of-bounds memory read potentially resulting in a denial of service.

Severity

1.9 (Low)


                        
                          CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L

Assigner

AMD

References

2 references

URL	Tags
https://www.amd.com/en/corporate/product-security…	vendor-advisory
https://www.amd.com/en/corporate/product-security…

Impacted products

7 products

Vendor	Product	Version
AMD	2nd Gen AMD EPYC™ Processors	Affected: various
AMD	3rd Gen AMD EPYC™ Processors	Affected: various
AMD	4th Gen AMD EPYC™ Processors	Affected: various
AMD	AMD EPYC™ Embedded 7002	Affected: various
AMD	AMD EPYC™ Embedded 7003	Affected: various
AMD	AMD EPYC™ Embedded 7002	Affected: various
AMD	AMD EPYC™ Embedded 7003	Affected: various

Date Public

2023-11-14 17:30

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T20:26:24.909Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-3002"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-5001"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "2nd Gen AMD EPYC\u2122 Processors",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "3rd Gen AMD EPYC\u2122 Processors",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "4th Gen AMD EPYC\u2122 Processors",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "AMD EPYC\u2122 Embedded 7002",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "AMD EPYC\u2122 Embedded 7003",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "AMD EPYC\u2122 Embedded 7002",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "AMD EPYC\u2122 Embedded 7003",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        }
      ],
      "datePublic": "2023-11-14T17:30:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Failure to validate the value in APCB may allow a privileged attacker to tamper with the APCB token to force an out-of-bounds memory read potentially resulting in a denial of service.\n\n\n\n\n\n\n\n\n\n\n\n\u003cbr\u003e"
            }
          ],
          "value": "Failure to validate the value in APCB may allow a privileged attacker to tamper with the APCB token to force an out-of-bounds memory read potentially resulting in a denial of service."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 1.9,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-18T18:38:22.990Z",
        "orgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
        "shortName": "AMD"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-3002"
        },
        {
          "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-5001"
        }
      ],
      "source": {
        "advisory": "AMD-SB-3002, AMD-5001",
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
    "assignerShortName": "AMD",
    "cveId": "CVE-2021-26345",
    "datePublished": "2023-11-14T18:53:20.979Z",
    "dateReserved": "2021-01-29T21:24:26.145Z",
    "dateUpdated": "2024-08-03T20:26:24.909Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-46758 (GCVE-0-2021-46758)

Vulnerability from cvelistv5 – Published: 2023-11-14 18:54 – Updated: 2024-08-04 05:17

Summary

Insufficient validation of SPI flash addresses in the ASP (AMD Secure Processor) bootloader may allow an attacker to read data in memory mapped beyond SPI flash resulting in a potential loss of availability and integrity.

Severity

No CVSS data available.

Assigner

AMD

References

1 reference

URL	Tags
https://www.amd.com/en/corporate/product-security…	vendor-advisory

Impacted products

9 products

Vendor	Product	Version
AMD	Ryzen™ 5000 Series Desktop Processor with Radeon™ Graphics “Cezanne”	Affected: various
AMD	Ryzen™ 7000 Series Desktop Processors “Raphael” XD3	Affected: various
AMD	Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics “Renoir” FP6	Affected: various
AMD	Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics “Lucienne”	Affected: various
AMD	Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics “Cezanne”	Affected: various
AMD	AMD Ryzen™ 6000 Series Processors with Radeon™ Graphics "Rembrandt"	Affected: various
AMD	AMD Ryzen™ 7035 Series Processors with Radeon™ Graphics “Rembrandt-R”	Affected: various
AMD	AMD Ryzen™ 5000 Series Processors with Radeon™ Graphics “Barcelo”	Affected: various
AMD	AMD Ryzen™ 7030 Series Mobile Processors with Radeon™ Graphics “Barcelo-R”	Affected: various

Date Public

2023-11-14 17:30

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:17:42.665Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-4002"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "Ryzen\u2122 5000 Series Desktop Processor with Radeon\u2122 Graphics  \u201cCezanne\u201d",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various "
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "Ryzen\u2122 7000 Series Desktop Processors \u201cRaphael\u201d XD3",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various "
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "Ryzen\u2122 4000 Series Mobile Processors with Radeon\u2122 Graphics \u201cRenoir\u201d FP6",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various "
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "Ryzen\u2122 5000 Series Mobile Processors with Radeon\u2122 Graphics \u201cLucienne\u201d",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various "
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "Ryzen\u2122 5000 Series Mobile Processors with Radeon\u2122 Graphics \u201cCezanne\u201d",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various "
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "AMD Ryzen\u2122 6000 Series Processors with Radeon\u2122 Graphics \"Rembrandt\"",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various "
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "AMD Ryzen\u2122 7035 Series Processors with Radeon\u2122 Graphics \u201cRembrandt-R\u201d",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various "
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "AMD Ryzen\u2122 5000 Series Processors with Radeon\u2122 Graphics  \u201cBarcelo\u201d",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various "
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "AMD Ryzen\u2122 7030 Series Mobile Processors with Radeon\u2122 Graphics \u201cBarcelo-R\u201d",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various "
            }
          ]
        }
      ],
      "datePublic": "2023-11-14T17:30:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Insufficient validation of SPI flash addresses in the ASP (AMD Secure Processor) bootloader may allow an attacker to read data in memory mapped beyond SPI flash resulting in a potential loss of availability and integrity.\n\n\n\n\n\n\n\n\u003cbr\u003e"
            }
          ],
          "value": "Insufficient validation of SPI flash addresses in the ASP (AMD Secure Processor) bootloader may allow an attacker to read data in memory mapped beyond SPI flash resulting in a potential loss of availability and integrity.\n\n\n\n\n\n\n\n\n"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-11-14T18:54:25.467Z",
        "orgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
        "shortName": "AMD"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-4002"
        }
      ],
      "source": {
        "advisory": "AMD-SB-4002",
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
    "assignerShortName": "AMD",
    "cveId": "CVE-2021-46758",
    "datePublished": "2023-11-14T18:54:25.467Z",
    "dateReserved": "2022-03-31T16:50:27.869Z",
    "dateUpdated": "2024-08-04T05:17:42.665Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-46766 (GCVE-0-2021-46766)

Vulnerability from cvelistv5 – Published: 2023-11-14 18:51 – Updated: 2024-08-04 05:17

Summary

Improper clearing of sensitive data in the ASP Bootloader may expose secret keys to a privileged attacker accessing ASP SRAM, potentially leading to a loss of confidentiality.

Severity

2.5 (Low)


                        
                          CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N

Assigner

AMD

References

3 references

URL	Tags
https://www.amd.com/en/corporate/product-security…	vendor-advisory
https://www.amd.com/en/corporate/product-security…	vendor-advisory
https://www.amd.com/en/corporate/product-security…	vendor-advisory

Impacted products

3 products

Vendor	Product	Version
AMD	Ryzen™ Threadripper™ PRO 3000WX Series Processors “Chagall” WS	Affected: various
AMD	4th Gen AMD EPYC™ Processors	Affected: various
AMD	AMD EPYC™ Embedded 9003	Affected: various

Date Public

2023-11-14 17:30

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:17:42.287Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-4002"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-3002"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-5001"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "Ryzen\u2122 Threadripper\u2122 PRO 3000WX Series Processors  \u201cChagall\u201d WS",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "4th Gen AMD EPYC\u2122 Processors",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "AMD EPYC\u2122 Embedded 9003",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        }
      ],
      "datePublic": "2023-11-14T17:30:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper clearing of sensitive data in the ASP Bootloader may expose secret keys to a privileged attacker accessing ASP SRAM, potentially leading to a loss of confidentiality.\u003cbr\u003e"
            }
          ],
          "value": "Improper clearing of sensitive data in the ASP Bootloader may expose secret keys to a privileged attacker accessing ASP SRAM, potentially leading to a loss of confidentiality."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 2.5,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-18T18:40:54.027Z",
        "orgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
        "shortName": "AMD"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-4002"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-3002"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-5001"
        }
      ],
      "source": {
        "advisory": "AMD-SB-4002, AMD-SB-3002, AMD-SB-5001",
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
    "assignerShortName": "AMD",
    "cveId": "CVE-2021-46766",
    "datePublished": "2023-11-14T18:51:58.036Z",
    "dateReserved": "2022-03-31T16:50:27.871Z",
    "dateUpdated": "2024-08-04T05:17:42.287Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-46774 (GCVE-0-2021-46774)

Vulnerability from cvelistv5 – Published: 2023-11-14 18:52 – Updated: 2024-10-11 18:07

Summary

Insufficient DRAM address validation in System Management Unit (SMU) may allow an attacker to read/write from/to an invalid DRAM address, potentially resulting in denial-of-service.

Severity

6.7 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:L

Assigner

AMD

References

3 references

URL	Tags
https://www.amd.com/en/corporate/product-security…	vendor-advisory
https://www.amd.com/en/corporate/product-security…	vendor-advisory
https://www.amd.com/en/corporate/product-security…	vendor-advisory

Impacted products

16 products

Vendor	Product	Version
AMD	Ryzen™ 3000 series Desktop Processors “Matisse"	Affected: various
AMD	AMD Ryzen™ 5000 Series Desktop Processors “Vermeer”	Affected: various
AMD	AMD Ryzen™ Threadripper™ 3000 Series Processors “Castle Peak” HEDT	Affected: various
AMD	AMD Ryzen™ Threadripper™ PRO Processors “Castle Peak” WS SP3	Affected: various
AMD	AMD Ryzen™ Threadripper™ PRO 3000WX Series Processors “Chagall” WS	Affected: various
AMD	1st Gen AMD EPYC™ Processors	Affected: various
AMD	2nd Gen AMD EPYC™ Processors	Affected: various
AMD	3rd Gen AMD EPYC™ Processors	Affected: various
AMD	4th Gen AMD EPYC™ Processors	Affected: various
AMD	AMD EPYC™ Embedded 3000	Affected: various
AMD	AMD EPYC™ Embedded 7002	Affected: various
AMD	AMD EPYC™ Embedded 7003	Affected: various
AMD	AMD Ryzen™ Embedded 5000	Affected: various
AMD	AMD EPYC™ Embedded 7002	Affected: various
AMD	AMD EPYC™ Embedded 3000	Affected: various
AMD	AMD EPYC™ Embedded 7003	Affected: various

Date Public

2023-11-14 17:30

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:17:42.622Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-4002"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-3002"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-5001"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-46774",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-11T17:51:52.542045Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-11T18:07:59.642Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "Ryzen\u2122 3000 series Desktop Processors \u201cMatisse\"",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "AMD Ryzen\u2122 5000 Series Desktop Processors \u201cVermeer\u201d",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "AMD Ryzen\u2122 Threadripper\u2122 3000 Series Processors \u201cCastle Peak\u201d HEDT",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "AMD Ryzen\u2122 Threadripper\u2122 PRO Processors \u201cCastle Peak\u201d WS SP3",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "AMD Ryzen\u2122 Threadripper\u2122 PRO 3000WX Series Processors  \u201cChagall\u201d WS",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "1st Gen AMD EPYC\u2122 Processors",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "2nd Gen AMD EPYC\u2122 Processors",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "3rd Gen AMD EPYC\u2122 Processors",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "4th Gen AMD EPYC\u2122 Processors",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "AMD EPYC\u2122 Embedded 3000",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "AMD EPYC\u2122 Embedded 7002",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "AMD EPYC\u2122 Embedded 7003",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "AMD Ryzen\u2122  Embedded 5000",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "AMD EPYC\u2122 Embedded 7002",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "AMD EPYC\u2122 Embedded 3000",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "AMD EPYC\u2122 Embedded 7003",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        }
      ],
      "datePublic": "2023-11-14T17:30:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Insufficient DRAM address validation in System\nManagement Unit (SMU) may allow an attacker to read/write from/to an invalid\nDRAM address, potentially resulting in denial-of-service.\n\n\n\n\n\n\n\n\n\n\n\n\u003cbr\u003e"
            }
          ],
          "value": "Insufficient DRAM address validation in System\nManagement Unit (SMU) may allow an attacker to read/write from/to an invalid\nDRAM address, potentially resulting in denial-of-service."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-18T18:31:43.449Z",
        "orgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
        "shortName": "AMD"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-4002"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-3002"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-5001"
        }
      ],
      "source": {
        "advisory": "AMD-SB-4002, AMD-SB-3002, AMD-SB-5001",
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
    "assignerShortName": "AMD",
    "cveId": "CVE-2021-46774",
    "datePublished": "2023-11-14T18:52:11.012Z",
    "dateReserved": "2022-03-31T16:50:27.874Z",
    "dateUpdated": "2024-10-11T18:07:59.642Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-23820 (GCVE-0-2022-23820)

Vulnerability from cvelistv5 – Published: 2023-11-14 18:52 – Updated: 2024-08-03 03:51

Summary

Failure to validate the AMD SMM communication buffer may allow an attacker to corrupt the SMRAM potentially leading to arbitrary code execution.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Assigner

AMD

References

3 references

URL	Tags
https://www.amd.com/en/corporate/product-security…	vendor-advisory
https://www.amd.com/en/corporate/product-security…	vendor-advisory
https://www.amd.com/en/corporate/product-security…	vendor-advisory

Impacted products

20 products

Vendor	Product	Version
AMD	Ryzen™ 3000 series Desktop Processors “Matisse"	Affected: various
AMD	AMD Ryzen™ 5000 Series Desktop Processors “Vermeer”	Affected: various
AMD	AMD Ryzen™ 5000 Series Desktop Processor with Radeon™ Graphics “Cezanne”	Affected: various
AMD	AMD Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics “Picasso” AM4	Affected: various
AMD	AMD Ryzen™ Threadripper™ 2000 Series Processors “Colfax”	Affected: Various
AMD	AMD Ryzen™ Threadripper™ 3000 Series Processors “Castle Peak” HEDT	Affected: various
AMD	AMD Ryzen™ Threadripper™ PRO Processors “Castle Peak” WS SP3	Affected: various
AMD	AMD Ryzen™ Threadripper™ PRO 3000WX Series Processors “Chagall” WS	Affected: various
AMD	AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics “Pollock”	Affected: various
AMD	AMD Ryzen™ 3000 Series Mobile Processor with Radeon™ Graphics “Picasso” FP5	Affected: various
AMD	AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics “Renoir” FP6	Affected: various
AMD	AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics “Lucienne”	Affected: various
AMD	AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics “Cezanne”	Affected: various
AMD	AMD Ryzen™ 6000 Series Processors with Radeon™ Graphics "Rembrandt"	Affected: various
AMD	AMD Ryzen™ 7035 Series Processors with Radeon™ Graphics “Rembrandt-R”	Affected: various
AMD	AMD Ryzen™ 5000 Series Processors with Radeon™ Graphics “Barcelo”	Affected: various
AMD	AMD Ryzen™ 7030 Series Mobile Processors with Radeon™ Graphics “Barcelo-R”	Affected: various
AMD	3rd Gen AMD EPYC™ Processors	Affected: various
AMD	AMD EPYC™ Embedded 7003	Affected: various
AMD	AMD EPYC™ Embedded 7003	Affected: various

Date Public

2023-11-14 17:30

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T03:51:46.067Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-4002"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-3002"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-5001"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "Ryzen\u2122 3000 series Desktop Processors \u201cMatisse\"",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "AMD Ryzen\u2122 5000 Series Desktop Processors \u201cVermeer\u201d",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "AMD Ryzen\u2122 5000 Series Desktop Processor with Radeon\u2122 Graphics  \u201cCezanne\u201d",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "AMD Athlon\u2122 3000 Series Desktop Processors with Radeon\u2122 Graphics \u201cPicasso\u201d AM4",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "AMD Ryzen\u2122 Threadripper\u2122 2000 Series Processors \u201cColfax\u201d",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "Various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "AMD Ryzen\u2122 Threadripper\u2122 3000 Series Processors \u201cCastle Peak\u201d HEDT",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "AMD Ryzen\u2122 Threadripper\u2122 PRO Processors \u201cCastle Peak\u201d WS SP3",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "AMD Ryzen\u2122 Threadripper\u2122 PRO 3000WX Series Processors  \u201cChagall\u201d WS",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "AMD Athlon\u2122 3000 Series Mobile Processors with Radeon\u2122 Graphics   \u201cPollock\u201d",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "AMD Ryzen\u2122 3000 Series Mobile Processor with Radeon\u2122 Graphics \u201cPicasso\u201d FP5",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "AMD Ryzen\u2122 4000 Series Mobile Processors with Radeon\u2122 Graphics \u201cRenoir\u201d FP6",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "AMD Ryzen\u2122 5000 Series Mobile Processors with Radeon\u2122 Graphics \u201cLucienne\u201d",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "AMD Ryzen\u2122 5000 Series Mobile Processors with Radeon\u2122 Graphics \u201cCezanne\u201d",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "AMD Ryzen\u2122 6000 Series Processors with Radeon\u2122 Graphics \"Rembrandt\"",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "AMD Ryzen\u2122 7035 Series Processors with Radeon\u2122 Graphics \u201cRembrandt-R\u201d",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "AMD Ryzen\u2122 5000 Series Processors with Radeon\u2122 Graphics  \u201cBarcelo\u201d",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "AMD Ryzen\u2122 7030 Series Mobile Processors with Radeon\u2122 Graphics \u201cBarcelo-R\u201d",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "3rd Gen AMD EPYC\u2122 Processors",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "AMD EPYC\u2122 Embedded 7003",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "AMD EPYC\u2122 Embedded 7003",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        }
      ],
      "datePublic": "2023-11-14T17:30:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Failure to validate the AMD SMM communication buffer\nmay allow an attacker to corrupt the SMRAM potentially leading to arbitrary\ncode execution.\n\n\n\n\n\n\n\n\u003cbr\u003e"
            }
          ],
          "value": "Failure to validate the AMD SMM communication buffer\nmay allow an attacker to corrupt the SMRAM potentially leading to arbitrary\ncode execution."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-18T18:28:41.324Z",
        "orgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
        "shortName": "AMD"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-4002"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-3002"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-5001"
        }
      ],
      "source": {
        "advisory": "AMD-SB-4002, AMD-SB-3002, AMD-SB-5001",
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
    "assignerShortName": "AMD",
    "cveId": "CVE-2022-23820",
    "datePublished": "2023-11-14T18:52:21.457Z",
    "dateReserved": "2022-01-21T17:20:55.778Z",
    "dateUpdated": "2024-08-03T03:51:46.067Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-23821 (GCVE-0-2022-23821)

Vulnerability from cvelistv5 – Published: 2023-11-14 18:54 – Updated: 2024-12-03 14:26

Summary

Improper access control in System Management Mode (SMM) may allow an attacker to write to SPI ROM potentially leading to arbitrary code execution.

Severity

No CVSS data available.

Assigner

AMD

References

2 references

URL	Tags
https://www.amd.com/en/corporate/product-security…	vendor-advisory
https://www.amd.com/en/corporate/product-security…	vendor-advisory

Impacted products

25 products

Vendor	Product	Version
AMD	Ryzen™ 3000 Series Desktop Processors “Matisse”	Affected: various
AMD	Ryzen™ 5000 Series Desktop Processors “Vermeer”	Affected: various
AMD	Ryzen™ 5000 Series Desktop Processor with Radeon™ Graphics “Cezanne”	Affected: various
AMD	Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics “Picasso” AM4	Affected: various
AMD	Ryzen™ Threadripper™ 2000 Series Processors “Colfax”	Affected: various
AMD	Ryzen™ Threadripper™ 3000 Series Processors “Castle Peak” HEDT	Affected: various
AMD	Ryzen™ Threadripper™ PRO Processors “Castle Peak” WS SP3	Affected: various
AMD	Ryzen™ Threadripper™ PRO 3000WX Series Processors “Chagall” WS	Affected: various
AMD	Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics “Dali”/”Dali” FP5	Affected: various
AMD	Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics “Pollock”	Affected: various
AMD	Ryzen™ 3000 Series Mobile Processor with Radeon™ Graphics “Picasso” FP5	Affected: various
AMD	Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics “Renoir” FP6	Affected: various
AMD	Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics “Lucienne”	Affected: various
AMD	Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics “Picasso” AM4	Affected: various
AMD	Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics “Cezanne”	Affected: various
AMD	AMD Ryzen™ 6000 Series Processors with Radeon™ Graphics "Rembrandt"	Affected: various
AMD	AMD Ryzen™ 7035 Series Processors with Radeon™ Graphics “Rembrandt-R”	Affected: various
AMD	AMD Ryzen™ 5000 Series Processors with Radeon™ Graphics “Barcelo”	Affected: various
AMD	AMD Ryzen™ 7030 Series Mobile Processors with Radeon™ Graphics “Barcelo-R”	Affected: various
AMD	AMD Ryzen™ Embedded R1000	Affected: various
AMD	AMD Ryzen™ Embedded R2000	Affected: various
AMD	AMD Ryzen™ Embedded 5000	Affected: various
AMD	AMD Ryzen™ Embedded V1000	Affected: various
AMD	AMD Ryzen™ Embedded V2000	Affected: various
AMD	AMD Ryzen™ Embedded V3000	Affected: various

Date Public

2023-11-14 17:30

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T03:51:46.017Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-4002"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-5001"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-23821",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2023-12-05T20:28:42.236096Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-03T14:26:05.643Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "Ryzen\u2122 3000 Series Desktop Processors \u201cMatisse\u201d",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various "
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "Ryzen\u2122 5000 Series Desktop Processors \u201cVermeer\u201d",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various "
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "Ryzen\u2122 5000 Series Desktop Processor with Radeon\u2122 Graphics  \u201cCezanne\u201d",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various "
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "Athlon\u2122 3000 Series Desktop Processors with Radeon\u2122 Graphics \u201cPicasso\u201d AM4",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various "
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "Ryzen\u2122 Threadripper\u2122 2000 Series Processors \u201cColfax\u201d",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various "
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "Ryzen\u2122 Threadripper\u2122 3000 Series Processors \u201cCastle Peak\u201d HEDT",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various "
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "Ryzen\u2122 Threadripper\u2122 PRO Processors \u201cCastle Peak\u201d WS SP3",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various "
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "Ryzen\u2122 Threadripper\u2122 PRO 3000WX Series Processors  \u201cChagall\u201d WS",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various "
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "Athlon\u2122 3000 Series Mobile Processors with Radeon\u2122 Graphics \u201cDali\u201d/\u201dDali\u201d FP5",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various "
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "Athlon\u2122 3000 Series Mobile Processors with Radeon\u2122 Graphics   \u201cPollock\u201d",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various "
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "Ryzen\u2122 3000 Series Mobile Processor with Radeon\u2122 Graphics \u201cPicasso\u201d FP5",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various "
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "Ryzen\u2122 4000 Series Mobile Processors with Radeon\u2122 Graphics \u201cRenoir\u201d FP6",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various "
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "Ryzen\u2122 5000 Series Mobile Processors with Radeon\u2122 Graphics \u201cLucienne\u201d",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various "
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "Athlon\u2122 3000 Series Desktop Processors with Radeon\u2122 Graphics \u201cPicasso\u201d AM4",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various "
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "Ryzen\u2122 5000 Series Mobile Processors with Radeon\u2122 Graphics \u201cCezanne\u201d",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various "
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "AMD Ryzen\u2122 6000 Series Processors with Radeon\u2122 Graphics \"Rembrandt\"",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various "
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "AMD Ryzen\u2122 7035 Series Processors with Radeon\u2122 Graphics \u201cRembrandt-R\u201d",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various "
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "AMD Ryzen\u2122 5000 Series Processors with Radeon\u2122 Graphics  \u201cBarcelo\u201d",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various "
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "AMD Ryzen\u2122 7030 Series Mobile Processors with Radeon\u2122 Graphics \u201cBarcelo-R\u201d",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various "
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "AMD Ryzen\u2122  Embedded R1000",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various "
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "AMD Ryzen\u2122  Embedded R2000",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various "
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "AMD Ryzen\u2122  Embedded 5000",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various "
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "AMD Ryzen\u2122  Embedded V1000",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "AMD Ryzen\u2122  Embedded V2000",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "AMD Ryzen\u2122  Embedded V3000",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        }
      ],
      "datePublic": "2023-11-14T17:30:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper access control in System Management Mode (SMM) may allow an attacker to write to SPI ROM potentially leading to arbitrary code execution.\n\n\n\n\n\n\n\n\u003cbr\u003e"
            }
          ],
          "value": "Improper access control in System Management Mode (SMM) may allow an attacker to write to SPI ROM potentially leading to arbitrary code execution.\n\n\n\n\n\n\n\n\n"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-02-13T19:26:03.900Z",
        "orgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
        "shortName": "AMD"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-4002"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-5001"
        }
      ],
      "source": {
        "advisory": "AMD-SB-4002, AMD-SB-5001",
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
    "assignerShortName": "AMD",
    "cveId": "CVE-2022-23821",
    "datePublished": "2023-11-14T18:54:32.952Z",
    "dateReserved": "2022-01-21T17:20:55.779Z",
    "dateUpdated": "2024-12-03T14:26:05.643Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-23830 (GCVE-0-2022-23830)

Vulnerability from cvelistv5 – Published: 2023-11-14 18:53 – Updated: 2024-08-03 03:51

Summary

SMM configuration may not be immutable, as intended, when SNP is enabled resulting in a potential limited loss of guest memory integrity.

Severity

1.9 (Low)


                        
                          CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N

Assigner

AMD

References

2 references

URL	Tags
https://www.amd.com/en/corporate/product-security…	vendor-advisory
https://www.amd.com/en/corporate/product-security…	vendor-advisory

Impacted products

3 products

Vendor	Product	Version
AMD	3rd Gen AMD EPYC™ Processors	Affected: various
AMD	4th Gen AMD EPY™ Processors	Affected: various
AMD	AMD EPYC™ Embedded 7003	Affected: various

Date Public

2023-11-14 17:30

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T03:51:45.987Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-3002"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-5001"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "3rd Gen AMD EPYC\u2122 Processors",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "4th Gen AMD EPY\u2122 Processors",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "AMD EPYC\u2122 Embedded 7003",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        }
      ],
      "datePublic": "2023-11-14T17:30:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "SMM configuration may not be immutable, as intended, when SNP is enabled resulting in a potential limited loss of guest memory integrity.\n\n\n\n\n\n\n\n\n\n\n\n\u003cbr\u003e"
            }
          ],
          "value": "SMM configuration may not be immutable, as intended, when SNP is enabled resulting in a potential limited loss of guest memory integrity."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 1.9,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-18T18:41:52.383Z",
        "orgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
        "shortName": "AMD"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-3002"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-5001"
        }
      ],
      "source": {
        "advisory": "AMD-SB-3002, AMD-SB-5001",
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
    "assignerShortName": "AMD",
    "cveId": "CVE-2022-23830",
    "datePublished": "2023-11-14T18:53:28.408Z",
    "dateReserved": "2022-01-21T17:20:55.781Z",
    "dateUpdated": "2024-08-03T03:51:45.987Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-20519 (GCVE-0-2023-20519)

Vulnerability from cvelistv5 – Published: 2023-11-14 18:53 – Updated: 2024-08-30 18:03

Summary

A Use-After-Free vulnerability in the management of an SNP guest context page may allow a malicious hypervisor to masquerade as the guest's migration agent resulting in a potential loss of guest integrity.

Severity

No CVSS data available.

Assigner

AMD

References

1 reference

URL	Tags
https://www.amd.com/en/corporate/product-security…	vendor-advisory

Impacted products

2 products

Vendor	Product	Version
AMD	3rd Gen AMD EPYC™ Processors	Affected: various
AMD	4th Gen AMD EPYC™ Processors	Affected: various

Date Public

2023-11-14 17:30

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T09:05:36.886Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-3002"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-20519",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-30T18:03:44.986937Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-30T18:03:55.829Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "3rd Gen AMD EPYC\u2122 Processors",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various "
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "4th Gen AMD EPYC\u2122 Processors ",
          "vendor": " AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various "
            }
          ]
        }
      ],
      "datePublic": "2023-11-14T17:30:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A Use-After-Free vulnerability in the management of an SNP guest context page may allow a malicious hypervisor to masquerade as the guest\u0027s migration agent resulting in a potential loss of guest integrity.\n\n\n\n\n\n\n\n\n\n\n\n\u003cbr\u003e"
            }
          ],
          "value": "A Use-After-Free vulnerability in the management of an SNP guest context page may allow a malicious hypervisor to masquerade as the guest\u0027s migration agent resulting in a potential loss of guest integrity.\n\n\n\n\n\n\n\n\n\n\n\n\n"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-11-14T18:53:36.329Z",
        "orgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
        "shortName": "AMD"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-3002"
        }
      ],
      "source": {
        "advisory": "AMD-SB-3002",
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
    "assignerShortName": "AMD",
    "cveId": "CVE-2023-20519",
    "datePublished": "2023-11-14T18:53:36.329Z",
    "dateReserved": "2022-10-27T18:53:39.736Z",
    "dateUpdated": "2024-08-30T18:03:55.829Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-20521 (GCVE-0-2023-20521)

Vulnerability from cvelistv5 – Published: 2023-11-14 18:52 – Updated: 2024-08-02 09:05

Summary

TOCTOU in the ASP Bootloader may allow an attacker with physical access to tamper with SPI ROM records after memory content verification, potentially leading to loss of confidentiality or a denial of service.

Severity

3.3 (Low)


                        
                          CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L

Assigner

AMD

References

3 references

URL	Tags
https://www.amd.com/en/corporate/product-security…	vendor-advisory
https://www.amd.com/en/corporate/product-security…	vendor-advisory
https://www.amd.com/en/corporate/product-security…	vendor-advisory

Impacted products

14 products

Vendor	Product	Version
AMD	Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics “Picasso” AM4	Affected: various
AMD	Ryzen™ Threadripper™ 2000 Series Processors “Colfax”	Affected: various
AMD	Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics “Dali”/”Dali” FP5	Affected: various
AMD	Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics “Pollock”	Affected: various
AMD	Ryzen™ 3000 Series Mobile Processor with Radeon™ Graphics “Picasso” FP5	Affected: various
AMD	1st Gen AMD EPYC™ Processors	Affected: various
AMD	2nd Gen AMD EPYC™ Processors	Affected: various
AMD	3rd Gen AMD EPYC™ Processors	Affected: various
AMD	AMD EPYC™ Embedded 3000	Affected: various
AMD	AMD EPYC™ Embedded 7002	Affected: various
AMD	AMD EPYC™ Embedded 7003	Affected: various
AMD	AMD Ryzen™ Embedded R1000	Affected: various
AMD	AMD Ryzen™ Embedded R2000	Affected: various
AMD	AMD Ryzen™ Embedded V1000	Affected: various

Date Public

2023-11-14 17:30

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-20521",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2023-11-27T19:38:18.334372Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-26T14:56:31.535Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T09:05:36.873Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-4002"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-3002"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-5001"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "Athlon\u2122 3000 Series Desktop Processors with Radeon\u2122 Graphics \u201cPicasso\u201d AM4",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "Ryzen\u2122 Threadripper\u2122 2000 Series Processors \u201cColfax\u201d",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "Athlon\u2122 3000 Series Mobile Processors with Radeon\u2122 Graphics \u201cDali\u201d/\u201dDali\u201d FP5",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "Athlon\u2122 3000 Series Mobile Processors with Radeon\u2122 Graphics   \u201cPollock\u201d",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "Ryzen\u2122 3000 Series Mobile Processor with Radeon\u2122 Graphics \u201cPicasso\u201d FP5",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "1st Gen AMD EPYC\u2122 Processors",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "2nd Gen AMD EPYC\u2122 Processors",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "3rd Gen AMD EPYC\u2122 Processors",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "AMD EPYC\u2122 Embedded 3000",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "AMD EPYC\u2122 Embedded 7002",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "AMD EPYC\u2122 Embedded 7003",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "AMD Ryzen\u2122 Embedded R1000",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "AMD Ryzen\u2122 Embedded R2000",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "AMD Ryzen\u2122 Embedded V1000",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        }
      ],
      "datePublic": "2023-11-14T17:30:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "TOCTOU in the ASP Bootloader may allow an attacker with physical access to tamper with SPI ROM records after memory content verification, potentially leading to loss of confidentiality or a denial of service.\n\n\n\n\n\n\n\n\n\n\n\n\u003cbr\u003e"
            }
          ],
          "value": "TOCTOU in the ASP Bootloader may allow an attacker with physical access to tamper with SPI ROM records after memory content verification, potentially leading to loss of confidentiality or a denial of service."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "PHYSICAL",
            "availabilityImpact": "LOW",
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-18T18:42:56.250Z",
        "orgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
        "shortName": "AMD"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-4002"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-3002"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-5001"
        }
      ],
      "source": {
        "advisory": "AMD-SB-4002, AMD-SB-3002, AMD-SB-5001",
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
    "assignerShortName": "AMD",
    "cveId": "CVE-2023-20521",
    "datePublished": "2023-11-14T18:52:31.662Z",
    "dateReserved": "2022-10-27T18:53:39.737Z",
    "dateUpdated": "2024-08-02T09:05:36.873Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-20526 (GCVE-0-2023-20526)

Vulnerability from cvelistv5 – Published: 2023-11-14 18:52 – Updated: 2024-08-02 09:05

Summary

Insufficient input validation in the ASP Bootloader may enable a privileged attacker with physical access to expose the contents of ASP memory potentially leading to a loss of confidentiality.

Severity

1.9 (Low)


                        
                          CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N

Assigner

AMD

References

3 references

URL	Tags
https://www.amd.com/en/corporate/product-security…	vendor-advisory
https://www.amd.com/en/corporate/product-security…	vendor-advisory
https://www.amd.com/en/corporate/product-security…	vendor-advisory

Impacted products

7 products

Vendor	Product	Version
AMD	AMD Ryzen™ Threadripper™ 2000 Series Processors “Colfax”	Affected: various
AMD	1st Gen AMD EPYC™ Processors	Affected: various
AMD	2nd Gen AMD EPYC™ Processors	Affected: various
AMD	3rd Gen AMD EPYC™ Processors	Affected: various
AMD	AMD EPYC™ Embedded 3000	Affected: various
AMD	AMD EPYC™ Embedded 7002	Affected: various
AMD	AMD EPYC™ Embedded 7003	Affected: various

Date Public

2023-11-14 17:30

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T09:05:36.942Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-4002"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-3002"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-5001"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "AMD Ryzen\u2122 Threadripper\u2122 2000 Series Processors \u201cColfax\u201d",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "1st Gen AMD EPYC\u2122 Processors",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "2nd Gen AMD EPYC\u2122 Processors",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "PI",
          "platforms": [
            "x86"
          ],
          "product": "3rd Gen AMD EPYC\u2122 Processors",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "AMD EPYC\u2122  Embedded 3000",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "AMD EPYC\u2122  Embedded 7002",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "AMD EPYC\u2122  Embedded 7003",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        }
      ],
      "datePublic": "2023-11-14T17:30:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Insufficient input validation in the ASP Bootloader may enable a privileged attacker with physical access to expose the contents of ASP memory potentially leading to a loss of confidentiality.\u003cbr\u003e"
            }
          ],
          "value": "Insufficient input validation in the ASP Bootloader may enable a privileged attacker with physical access to expose the contents of ASP memory potentially leading to a loss of confidentiality."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "PHYSICAL",
            "availabilityImpact": "NONE",
            "baseScore": 1.9,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-18T18:43:52.998Z",
        "orgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
        "shortName": "AMD"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-4002"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-3002"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-5001"
        }
      ],
      "source": {
        "advisory": "AMD-SB-4002, AMD-SB-3002, AMD-SB-5001",
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
    "assignerShortName": "AMD",
    "cveId": "CVE-2023-20526",
    "datePublished": "2023-11-14T18:52:41.992Z",
    "dateReserved": "2022-10-27T18:53:39.737Z",
    "dateUpdated": "2024-08-02T09:05:36.942Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

WID-SEC-W-2023-2916

CVE-2021-26345 (GCVE-0-2021-26345)

CVE-2021-46758 (GCVE-0-2021-46758)

CVE-2021-46766 (GCVE-0-2021-46766)

CVE-2021-46774 (GCVE-0-2021-46774)

CVE-2022-23820 (GCVE-0-2022-23820)

CVE-2022-23821 (GCVE-0-2022-23821)

CVE-2022-23830 (GCVE-0-2022-23830)

CVE-2023-20519 (GCVE-0-2023-20519)

CVE-2023-20521 (GCVE-0-2023-20521)

CVE-2023-20526 (GCVE-0-2023-20526)

Tags

Sightings

Nomenclature