CVE-2023-31100

Improper Access Control in SMI handler vulnerability in Phoenix SecureCore™ Technology™ 4 allows SPI flash modification. This issue affects SecureCore™ Technology™ 4: from 4.3.0.0 before 4.3.0.203 from 4.3.1.0 before 4.3.1.163 from 4.4.0.0 before 4.4.0.217 from 4.5.0.0 before 4.5.0.138...

CVE-2022-23821

Improper access control in System Management Mode SMM may allow an attacker to write to SPI ROM potentially leading to arbitrary code execution...

CVE-2022-23821

Improper access control in System Management Mode SMM may allow an attacker to write to SPI ROM potentially leading to arbitrary code execution...

CVE-2021-46758

Insufficient validation of SPI flash addresses in the ASP AMD Secure Processor bootloader may allow an attacker to read data in memory mapped beyond SPI flash resulting in a potential loss of availability and integrity...

Denial of service

TOCTOU in the ASP Bootloader may allow an attacker with physical access to tamper with SPI ROM records after memory content verification, potentially leading to loss of confidentiality or a denial of service...

Input validation

Insufficient validation of SPI flash addresses in the ASP AMD Secure Processor bootloader may allow an attacker to read data in memory mapped beyond SPI flash resulting in a potential loss of availability and integrity...

Improper access control

Improper access control in System Management Mode SMM may allow an attacker to write to SPI ROM potentially leading to arbitrary code execution...

CVE-2022-23821

Improper access control in System Management Mode SMM may allow an attacker to write to SPI ROM potentially leading to arbitrary code execution...

CVE-2022-23821

Improper access control in System Management Mode SMM may allow an attacker to write to SPI ROM potentially leading to arbitrary code execution...

CVE-2022-23821

CVE-2022-23821 describes an improper access control in AMD System Management Mode (SMM) that could allow an attacker to write to SPI ROM and potentially achieve arbitrary code execution. Connected sources indicate this affects AMD ASP/SMM components and is mitigated by Platform Initialization (PI...

CVE-2021-46758

CVE-2021-46758 involves insufficient validation of SPI flash addresses in the AMD Secure Processor (ASP) bootloader. The issue may allow an attacker to read data mapped beyond SPI flash, potentially impacting availability and integrity. Related documents confirm the vulnerability in ASP bootloade...

CVE-2021-46758

Insufficient validation of SPI flash addresses in the ASP AMD Secure Processor bootloader may allow an attacker to read data in memory mapped beyond SPI flash resulting in a potential loss of availability and integrity...

CVE-2023-20521

CVE-2023-20521 describes a TOCTOU flaw in the AMD ASP Bootloader that could let an attacker with physical access tamper SPI ROM records after memory verification, risking confidentiality loss and potential DoS. Connected sources (SUSE kernel-firmware updates and AMD/SUSe advisories) confirm this ...

CVE-2023-20521

TOCTOU in the ASP Bootloader may allow an attacker with physical access to tamper with SPI ROM records after memory content verification, potentially leading to loss of confidentiality or a denial of service...

CVE-2023-20521

TOCTOU in the ASP Bootloader may allow an attacker with physical access to tamper with SPI ROM records after memory content verification, potentially leading to loss of confidentiality or a denial of service...

AMD EPYC Security Vulnerability

AMD EPYC is a line of x86 architecture server microprocessors from AMD, known in Chinese as "霄龙", which utilizes the Zen microarchitecture. A security vulnerability exists in AMD EPYC, which stems from a TOCTOU in the ASP bootloader that could allow an attacker with physical access to tamper with...

PT-2023-12572 · Amd · Amd Secure Processor

Name of the Vulnerable Software and Affected Versions: AMD Secure Processor affected versions not specified Description: The issue is related to insufficient validation of SPI flash addresses in the ASP bootloader, which may allow an attacker to read data in memory mapped beyond SPI flash. This...

PT-2023-23155 · Unknown · Securecore Technology 4

Name of the Vulnerable Software and Affected Versions: SecureCore Technology 4 versions 4.3.0.0 through 4.3.0.202 SecureCore Technology 4 versions 4.3.1.0 through 4.3.1.162 SecureCore Technology 4 versions 4.4.0.0 through 4.4.0.216 SecureCore Technology 4 versions 4.5.0.0 through 4.5.0.137...

kernel: tpm: fix reference counting for struct tpm_chip

In the Linux kernel, the following vulnerability has been resolved: tpm: fix reference counting for struct tpmchip The following sequence of operations results in a refcount warning: 1. Open device /dev/tpmrm. 2. Remove module tpmtisspi. 3. Write a TPM command to the file descriptor opened at ste...

Researchers Find 34 Windows Drivers Vulnerable to Full Device Takeover

As many as 34 unique vulnerable Windows Driver Model WDM and Windows Driver Frameworks WDF drivers could be exploited by non-privileged threat actors to gain full control of the devices and execute arbitrary code on the underlying systems. "By exploiting the drivers, an attacker without privilege...