CVE-2022-23824

Summary: CVE-2022-23824 is listed as a Xen-related vulnerability in Debian security advisories and Gentoo GLSA, indicating multiple vulnerabilities in the Xen hypervisor that could lead to privilege escalation, denial of service, or information leaks. The Debian entry explicitly groups CVE-2022-2...

CVE-2021-26316

CVE-2021-26316 describes a BIOS-level input/communication buffer validation flaw in AMD platforms that may allow a local attacker with low privileges to tamper BIOS buffers and trigger SMM (System Management Mode) arbitrary code execution. Connected sources confirm the root cause is inadequate va...

CVE-2021-46744

Technical details about CVE-2021-46744 are not publicly provided in the supplied Connected documents. The initial entry mentions a SEV data-inference risk on AMD SEV guests, but no product/version/root-cause/fix is given here. Monitor for updates.

CVE-2020-12954

CVE-2020-12954 relates to an AMD Platform Security Processor (ASP) boot loader header where improper input and range validation can allow attacker-controlled values before signature verification, potentially enabling arbitrary code execution and bypassing SPI ROM protections to modify SPI ROM. Th...

CVE-2021-26354

CVE-2021-26354 affects AMD’s ASP/Bootloader pathway (ASP/ABL) with Insufficient bounds checking that may allow a system call from a compromised ABL, initializing arbitrary memory to zero and potentially compromising integrity. The vulnerability is documented across multiple sources (NVD entry and...

CVE-2021-46778

CVE-2021-46778 describes an information-disclosure side-channel vulnerability in AMD CPUs with SMT (Zen 1–Zen 4). The root cause is execution unit scheduler contention on SMT-enabled cores, allowing an attacker to infer data by measuring scheduler-queue contention. Public documents identify affec...

CVE-2021-26335

CVE-2021-26335 concerns the AMD Secure Processor (ASP) boot loader image header. The issue is improper input and range checking, enabling attacker-controlled values before signature validation and potentially allowing arbitrary code execution. In NVD/AMD documentation, the vulnerability is listed...

CVE-2021-26398

CVE-2021-26398 affects the AMD Secure Processor (ASP) via insufficient input validation in SYS_KEY_DERIVE. A compromised user application or ABL may corrupt ASP OS memory, potentially enabling arbitrary code execution. Public details identify the vulnerability and associated risk to ASP/firmware,...

CVE-2021-26371

The CVE-2021-26371 entry concerns AMD Secure Processor (ASP)/AMD System Management Unit (SMU) where a compromised ABL or UApp could trigger a SHA256 system call to the bootloader, potentially exposing ASP memory to userspace and causing information disclosure. Technical details from connected sou...

CVE-2020-12966

CVE-2020-12966 corresponds to an information-disclosure vulnerability in AMD EPYC processors’ SEV-ES and SEV-SNP. A local authenticated attacker could leak guest data via the malicious hypervisor. Affected products include AMD EPYC generations with SEV/SEV-ES, with SEV-SNP enabling a mitigation p...

CVE-2021-26402

CVE-2021-26402 describes insufficient bounds checking in the AMD Secure Processor (ASP) firmware during BIOS mailbox handling, enabling an attacker to write partially controlled data out-of-bounds into SMM or SEV-ES regions and potentially compromise integrity and availability. The issue is discu...

CVE-2020-12988

CVE-2020-12988 affects AMD EPYC platforms (1st–3rd Gen) per AMD-SB-1021. The DoS issue is described as a hang during system reboot in the integrated chipset/AMD platform components (e.g., ASP/SMU/SEV family). Affected products include 1st Gen EPYC (Naples), 2nd Gen (Rome), and 3rd Gen (Milan) CPU...

CVE-2021-26336

CVE-2021-26336 concerns AMD System Management Unit (SMU) with insufficient bounds checking that can cause invalid memory accesses/updates, leading to an SMU hang and the system may fail to service further requests from other components. Multiple sources confirm the issue under the SMU and referen...

CVE-2023-20594

CVE-2023-20594 concerns the AMD DXE driver. The root cause is improper initialization of variables in the DXE driver, which may allow a privileged local user to leak sensitive information. Impact is information disclosure with local access; attack vector is local. The vulnerability affects AMD DX...

CVE-2021-26343

CVE-2021-26343 describes insufficient validation in AMD’s ASP BIOS and DRTM commands, potentially allowing malicious supervisor x86 software to disclose memory contents (information disclosure). The vulnerability is linked to the AMD Secure Processor (ASP) and BIOS/DRTM handling, with impact limi...

CVE-2023-20530

CVE-2023-20530 concerns the AMD System Management Unit (SMU) on AMD EPYC-based platforms. It involves insufficient input validation of BIOS mailbox messages in SMU, which can cause out-of-bounds memory reads and potentially lead to a denial of service. Public sources consistently describe the aff...

CVE-2023-20527

CVE-2023-20527 concerns the AMD Secure Processor (ASP) Bootloader. The issue is an improper syscall input validation in the Bootloader, which may allow a privileged attacker to read memory out-of-bounds, potentially causing a denial-of-service. The CVSS v3.1 metrics indicate Network attack vector...

CVE-2021-26315

CVE-2021-26315: The AMD Platform Security Processor (PSP) boot ROM decrypts encrypted firmware but does not adequately verify the integrity of the decrypted image, potentially allowing arbitrary code execution in the PSP when using encrypted firmware. The issue is described across multiple source...

CVE-2023-20525

The CVE-2023-20525 issue affects the AMD Secure Processor (ASP) Bootloader: it is caused by insufficient syscall input validation that can allow a privileged attacker to read memory outside mapped register bounds, potentially causing a denial of service. Public details identify the affected compo...

CVE-2023-20529

The CVE-2023-20529 issue affects the AMD System Management Unit (SMU) , where insufficient bound checks can allow an attacker to update the sender/receiver address space to an invalid value, potentially causing a denial of service. The vulnerability is tied to SMU/firmware handling and is documen...

CVE-2020-12951

CVE-2020-12951 describes a race condition in the AMD Platform Security Processor (ASP) firmware that could allow less-privileged x86 code to perform ASP SMM operations. Connected sources confirm this vulnerability and tie it to AMD ASP/SMU firmware, with AMD advisories indicating mitigations via ...

CVE-2023-20523

CVE-2023-20523 concerns TOCTOU in the AMD Secure Processor (ASP) that may allow a physical attacker to write beyond buffer bounds, potentially causing loss of integrity or denial of service. The issue is documented across multiple sources (NVD/NCSC/Dell AMD bulletins) with the ASP as the affected...

CVE-2023-20531

CVE-2023-20531 affects the AMD System Management Unit (SMU) in AMD EPYC platforms. The root cause is insufficient bound checks in SMU, allowing an attacker to update SRAM between address spaces to an invalid value, which can lead to a denial of service. Connected documents provide concrete detail...

CVE-2021-26337

The CVE-2021-26337 issue is an AMD SMU (System Management Unit) DRAM address validation flaw. It can permit a DMA read from an invalid DRAM address into SRAM, causing the SMU to stop servicing further requests. Mitigations are provided by AMD/AGSIA: update to the specified AGESA PI software versi...

CVE-2021-26355

CVE-2021-26355 affects AMD System Management Unit (SMU) in AMD EPYC platform family. The root cause is insufficient fencing and checks in the SMU, which may allow access to invalid message port registers and could lead to a denial-of-service. The AMD security bulletin AMD-SB-1032 documents mitiga...

CVE-2021-26404

CVE-2021-26404 affects AMD SEV firmware; root cause is improper input validation and bounds checking that may leak scratch buffer bytes, potentially leading to information disclosure. Documents indicate mitigations via AMD’s BIOS updates (AMD-SB-1032) with platform-specific versions (e.g., MilanP...

CVE-2023-20528

CVE-2023-20528 concerns the AMD System Management Unit (SMU) . The issue is caused by insufficient input validation in the SMU firmware , which could let a physical attacker exfiltrate SMU memory contents via the I2C bus, potentially resulting in a loss of confidentiality. Affected product scope ...

CVE-2021-26331

CVE-2021-26331 affects the AMD System Management Unit (SMU). The vulnerability description indicates a malicious user could manipulate mailbox entries to achieve arbitrary code execution. Impact and exploit details are not provided beyond this, but the AMD-SB-1021 bulletin notes mitigations via O...

CVE-2023-20532

CVE-2023-20532 describes insufficient input validation in the AMD System Management Unit (SMU) that may allow an attacker to lock resources and cause a denial of service. Connected AMD documentation confirms the vulnerability affects SMU components and provides mitigations in the AMD-SB-1032 bull...

CVE-2021-26330

CVE-2021-26330 describes a heap-based overflow in the AMD System Management Unit (SMU) that may result in resource loss. Connected sources confirm affected hardware as AMD EPYC generations (1st/2nd/3rd Gen) and associate the issue with SMU/ASP components. The AMD Bulletin AMD-SB-1021 provides mit...

CVE-2020-12961

CVE-2020-12961 affects AMD Platform Security Processor (PSP). The issue could allow an attacker to zero a privileged register on the System Management Network, potentially bypassing SPI ROM protections. Documented impact is high (CVSSv3.1: 7.8 Local, High impact) with local access and no user int...

CVE-2021-26396

The CVE-2021-26396 issue affects the AMD Secure Processor (ASP) where insufficient validation of address mapping to IO can lead to loss of memory integrity in the SNP guest. The entry is supported by multiple sources (NVD/NCSC AMD SB) detailing the vulnerability and its scope across AMD EPYC gene...

CVE-2021-26327

The CVE-2021-26327 entry concerns AMD SNP Firmware. Affected component: AMD SNP Firmware; root cause: insufficient validation of guest context, leading to potential loss of guest confidentiality. Impact: confidentiality can be partially exposed (per CVSS notes), with local access required. Public...

CVE-2021-26328

CVE-2021-26328 describes a vulnerability in AMD’s Secure Processor/AMD EPYC platform related to SNP_INIT. The issue is a failure to verify the mode of CPU execution during SNP_INIT, which may lead to a potential loss of memory integrity for SNP guests. The AMD security bulletin AMD-SB-1032 docume...