Lucene search

Amd.comAMD-SB-4001

HistoryMay 09, 2023 - 12:00 a.m.

Client Vulnerabilities – May 2023

2023-05-0900:00:00

amd.com

www.amd.com

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.001 Low

EPSS

Percentile

47.6%

JSON

**Bulletin ID:**AMD-SB-4001 **Potential Impact:**Varies by CVE, see descriptions below **Severity:**Varies by CVE, see descriptions below

Summary

Potential vulnerabilities in AMD Secure Processor (ASP), AMD System Management Unit (SMU), and other platform components were discovered, and mitigations are being provided in AGESA™ PI software packages.

Affected Products

AMD Athlon™ Processors, Ryzen™ Processors, Threadripper™ Processors

CVE Details

Refer to Glossary for explanation of terms

CVE	Severity	CVE Description
CVE-2020-12930	High	Improper parameters handling in AMD Platform Security Processor (PSP) drivers may allow a privileged attacker to elevate their privileges.
CVE-2020-12931	High	Improper parameters handling in the AMD Platform Security Processor (PSP) kernel may allow a privileged attacker to elevate their privileges
CVE-2021-26354	Medium__	Insufficient bounds checking in ASP may allow an attacker to issue a system call from a compromised ABL which may cause arbitrary memory values to be initialized to zero, potentially leading to a loss of integrity.__
CVE-2021-26371	Medium	A compromised or malicious ABL or UApp could send a SHA256 system call to the bootloader, which may result in exposure of ASP memory to userspace, potentially leading to information disclosure.
CVE-2021-26391	Medium	Insufficient verification of multiple header signatures while loading a Trusted Application (TA) may allow an attacker with privileges to gain code execution in that TA or the OS/kernel.
CVE-2021-26392	Medium	Insufficient verification of missing size check in ‘LoadModule’ may lead to an out-of-bounds write allowing an attacker with privileges to gain code execution of the secure OS/kernel by loading a malicious TA.
CVE-2021-46760	Medium	A malicious or compromised UApp or ABL can send a malformed system call to the bootloader, which may result in an out-of-bounds memory access that may potentially lead to an attacker leaking sensitive information or achieving code execution.
CVE-2021-46773	Medium	Insufficient input validation in ABL may enable a privileged attacker to corrupt ASP memory, potentially resulting in a loss of integrity or code execution.
CVE-2021-46756	Medium	Insufficient validation of inputs in SVC_MAP_USER_STACK in the ASP (AMD Secure Processor) bootloader may allow an attacker with a malicious Uapp or ABL to send malformed or invalid syscall to the bootloader resulting in a potential denial of service and loss of integrity.
CVE-2021-46753	Medium	Failure to validate the length fields of the ASP (AMD Secure Processor) sensor fusion hub headers may allow an attacker with a malicious Uapp or ABL to map the ASP sensor fusion hub region and overwrite data structures leading to a potential loss of confidentiality and integrity.
CVE-2021-46754	Medium	Insufficient input validation in the ASP (AMD Secure Processor) bootloader may allow an attacker with a compromised Uapp or ABL to coerce the bootloader into exposing sensitive information to the SMU (System Management Unit) resulting in a potential loss of confidentiality and integrity.
CVE-2021-26365	Medium	Certain size values in firmware binary headers could trigger out of bounds reads during signature validation, leading to denial of service or potentially limited leakage of information about out-of-bounds memory contents.
CVE-2021-26356	Medium	A TOCTOU in ASP bootloader may allow an attacker to tamper with the SPI ROM following data read to memory potentially resulting in S3 data corruption and information disclosure.
CVE-2021-26393	Medium	Insufficient memory cleanup in the AMD Secure Processor (ASP) Trusted Execution Environment (TEE) may allow an authenticated attacker with privileges to generate a valid signed TA and potentially poison the contents of the process memory with attacker-controlled data resulting in a loss of confidentiality.
CVE-2021-26406	Medium	Insufficient validation in parsing Owner’s Certificate Authority (OCA) certificates in SEV (AMD Secure Encrypted Virtualization) and SEV-ES user application can lead to a host crash potentially resulting in denial of service.
CVE-2021-46749	Medium	Insufficient bounds checking in ASP (AMD Secure Processor) may allow for an out of bounds read in SMI (System Management Interface) mailbox checksum calculation triggering a data abort, resulting in a potential denial of service.
CVE-2021-46755	Medium	Failure to unmap certain SysHub mappings in error paths of the ASP (AMD Secure Processor) bootloader may allow an attacker with a malicious bootloader to exhaust the SysHub resources resulting in a potential denial of service.
CVE-2021-46792	Medium	Time-of-check Time-of-use (TOCTOU) in the BIOS2PSP command may allow an attacker with a malicious BIOS to create a race condition causing the ASP bootloader to perform out-of-bounds SRAM reads upon an S3 resume event potentially leading to a denial of service.
CVE-2021-46794	Medium	Insufficient bounds checking in ASP (AMD Secure Processor) may allow for an out of bounds read in SMI (System Management Interface) mailbox checksum calculation triggering a data abort, resulting in a potential denial of service.
CVE-2021-46765	Low	Insufficient input validation in ASP may allow an attacker with a compromised SMM to induce out-of-bounds memory reads within the ASP, potentially leading to a denial of service.
CVE-2021-46759	Low	Improper syscall input validation in AMD TEE (Trusted Execution Environment) may allow an attacker with physical access and control of a Uapp that runs under the bootloader to reveal the contents of the ASP (AMD Secure Processor) bootloader accessible memory to a serial port, resulting in a potential loss of integrity.

Mitigation

The AGESA™ versions listed below have been released to the Original Equipment Manufacturers (OEM) to help mitigate these issues. Please refer to your OEM for the BIOS update specific to your product.

DESKTOP

HIGH END DESKTOP

CVE|2nd Gen AMD Ryzen™ Threadripper™ Processors
“Colfax”|3rd Gen AMD Ryzen™ Threadripper™ Processors
“Castle Peak” HEDT
—|—|—
Minimum version to mitigate all listed CVEs|SummitPI-SP3r2 1.1.0.5
|CastlePeakPI-SP3r3 1.0.0.7
CVE-2020-12930| N/A| CastlePeakPI-SP3r3 1.0.0.7
CVE-2020-12931| N/A| CastlePeakPI-SP3r3 1.0.0.7
CVE-2021-26354| SummitPI-SP3r2 1.1.0.5| CastlePeakPI-SP3r3 1.0.0.7
CVE-2021-26356****| N/A| CastlePeakPI-SP3r3 1.0.0.7
CVE-2021-26365****| N/A| N/A
CVE-2021-26371****| N/A| CastlePeakPI-SP3r3 1.0.0.7
CVE-2021-26391****| N/A| N/A
CVE-2021-26392****| N/A| CastlePeakPI-SP3r3 1.0.0.7
CVE-2021-26393****| N/A| N/A
CVE-2021-26406****| SummitPI-SP3r2 1.1.0.5| CastlePeakPI-SP3r3 1.0.0.7
CVE-2021-46749****| N/A| CastlePeakPI-SP3r3 1.0.0.7
CVE-2021-46753****| N/A| N/A
CVE-2021-46754****| N/A| N/A
CVE-2021-46755****| N/A| CastlePeakPI-SP3r3 1.0.0.7
CVE-2021-46756****| SummitPI-SP3r2 1.1.0.5| CastlePeakPI-SP3r3 1.0.0.7
CVE-2021-46759****| N/A| N/A
CVE-2021-46760****| N/A| CastlePeakPI-SP3r3 1.0.0.7
CVE-2021-46765****| N/A| N/A
CVE-2021-46773****| N/A| CastlePeakPI-SP3r3 1.0.0.7
CVE-2021-46792****| N/A| N/A
CVE-2021-46794****| N/A| CastlePeakPI-SP3r3 1.0.0.7

WORKSTATION

MOBILE - AMD Athlon™ Series

MOBILE - AMD Ryzen™ Series

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.001 Low

EPSS

Percentile

47.6%

JSON

Related for AMD-SB-4001