CVE-2021-46756: Improper Input Validation

Insufficient validation of inputs in SVCMAPUSERSTACK in the ASP AMD Secure Processor bootloader may allow an attacker with a malicious Uapp or ABL to send malformed or invalid syscall to the bootloader resulting in a potential denial of service and loss of integrity...

CVE-2021-46760: Improper Restriction of Operations within the Bounds of a Memory Buffer

A malicious or compromised UApp or ABL can send a malformed system call to the bootloader, which may result in an out-of-bounds memory access that may potentially lead to an attacker leaking sensitive information or achieving code execution...

PT-2023-12093 · Amd · 1St Gen Amd Epyc™ Processors +110

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: A compromised or malicious ABL or UApp could send a SHA256 system call to the bootloader, which may result in exposure of ASP memory to userspace,...

PT-2023-12574

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided descriptions. Description A malicious or compromised UApp or ABL can send a malformed system call to the bootloader, which may result in an out-of-bounds memory access. This could...

PT-2023-12570

Name of the Vulnerable Software and Affected Versions AMD Secure Processor affected versions not specified Description The issue is related to the failure to unmap certain SysHub mappings in error paths of the ASP bootloader, which may allow an attacker with a malicious bootloader to exhaust the...

CVE-2021-26356: Time-of-check Time-of-use (TOCTOU) Race Condition

A TOCTOU in ASP bootloader may allow an attacker to tamper with the SPI ROM following data read to memory potentially resulting in S3 data corruption and information disclosure...

CVE-2021-46754: Improper Input Validation

Insufficient input validation in the ASP AMD Secure Processor bootloader may allow an attacker with a compromised Uapp or ABL to coerce the bootloader into exposing sensitive information to the SMU System Management Unit resulting in a potential loss of confidentiality and integrity...

CVE-2021-46769: Improper Input Validation

Insufficient syscall input validation in the ASP Bootloader may allow a privileged attacker to execute arbitrary DMA copies, which can lead to code execution...

PT-2023-12586

Name of the Vulnerable Software and Affected Versions ASP bootloader affected versions not specified Description The issue is related to a Time-of-check Time-of-use TOCTOU condition in the BIOS2PSP command. This may allow an attacker with a malicious BIOS to create a race condition, causing the A...

CVE-2023-20520: Out-of-bounds Write

Improper access control settings in ASP Bootloader may allow an attacker to corrupt the return address causing a stack-based buffer overrun potentially leading to arbitrary code execution...

CVE-2021-46792: Time-of-check Time-of-use (TOCTOU) Race Condition

Time-of-check Time-of-use TOCTOU in the BIOS2PSP command may allow an attacker with a malicious BIOS to create a race condition causing the ASP bootloader to perform out-of-bounds SRAM reads upon an S3 resume event potentially leading to a denial of service...

CVE-2023-21489

Heap out-of-bounds write vulnerability in bootloader prior to SMR May-2023 Release 1 allows a physical attacker to execute arbitrary code...

CVE-2023-21489

Heap out-of-bounds write vulnerability in bootloader prior to SMR May-2023 Release 1 allows a physical attacker to execute arbitrary code...

Heap overflow

Heap out-of-bounds write vulnerability in bootloader prior to SMR May-2023 Release 1 allows a physical attacker to execute arbitrary code...

SAMSUNG Mobile devices 缓冲区错误漏洞

SAMSUNG Mobile devices are a range of Samsung mobile devices, including cell phones, tablets, and more, from the South Korean company Samsung SAMSUNG. A security vulnerability previously existed in SAMSUNG Mobile devices SMR May-2023 Release 1 version, which stemmed from a bootloader program that...

CVE-2023-21489

Heap out-of-bounds write vulnerability in bootloader prior to SMR May-2023 Release 1 allows a physical attacker to execute arbitrary code...

CVE-2023-21489

CVE-2023-21489 is a heap out-of-bounds write vulnerability in the bootloader of Samsung Mobile devices, prior to SMR May-2023 Release 1, allowing a physical attacker to execute arbitrary code. The issue affects the bootloader function/section used during device startup and is exploitable with phy...

CVE-2023-21489

Heap out-of-bounds write vulnerability in bootloader prior to SMR May-2023 Release 1 allows a physical attacker to execute arbitrary code...

PT-2023-18242 · Unknown · Bootloader

Name of the Vulnerable Software and Affected Versions: Bootloader versions prior to SMR May-2023 Release 1 Description: A heap out-of-bounds write issue allows a physical attacker to execute arbitrary code. Recommendations: For versions prior to SMR May-2023 Release 1, update to SMR May-2023...

CVE-2023-21489: Out-of-bounds Write

Heap out-of-bounds write vulnerability in bootloader prior to SMR May-2023 Release 1 allows a physical attacker to execute arbitrary code...