CVE-2021-26350

The CVE-2021-26350 entry describes a TOCTOU race in the AMD System Management Unit (SMU) that could allow a caller to obtain and manipulate the address of a message port register, potentially causing denial of service. The linked SUSE/SUSE-SU advisories enumerate this vulnerability alongside othe...

CVE-2021-26372

CVE-2021-26372 is present in multiple SUSE kernel-firmware advisories (e.g., SUSE-SU-2022:1840/1846/1847-1) as part of a set of issues affecting the System Management Unit (SMU) and AMD-related firmware. The core issue is insufficient bound checks related to PCIE in the SMU, which could allow acc...

CVE-2021-26316

CVE-2021-26316 describes a BIOS-level input/communication buffer validation flaw in AMD platforms that may allow a local attacker with low privileges to tamper BIOS buffers and trigger SMM (System Management Mode) arbitrary code execution. Connected sources confirm the root cause is inadequate va...

CVE-2021-26376

CVE-2021-26376 is referenced across multiple SUSE kernel-firmware advisories (SUSE-SU-2022-1840/1846/1847-1, etc.) as part of a family of SMU flaws. The description in the CVE entry states that insufficient checks in the System Management Unit (SMU) FeatureConfig may reenforce features and cause ...

CVE-2021-26347

CVE-2021-26347 is referenced in several advisories as part of AMD/ kernel-firmware updates. The description states a failure to validate the integer operand in the AMD Secure Processor bootloader could allow an integer overflow in the L2 directory table in SPI flash, potentially causing a denial ...

CVE-2021-26375

Technical details for CVE-2021-26375 are not publicly provided in the supplied documents; no affected products, exploit vectors, or fixes are stated here. Monitor for updates from the listed advisories.

CVE-2021-26388

CVE-2021-26388 matches the initial description: improper validation of the BIOS directory can cause reads beyond the RAM directory table, exposing out-of-bounds memory and potentially causing a denial of service. Connected advisories (SUSE-SU-2022:1840-1, 1846-1, 1847-1) reference this CVE as par...

CVE-2021-26378

CVE-2021-26378 is an SMU (System Management Unit) bound-check issue that can cause denial of service by exposing invalid address space. The descriptor in the initial document states only a bound-check deficiency in the SMU leading to DoS, with CVSS v3.1 base score 5.5 (Local, Low privileges requi...

CVE-2020-12954

CVE-2020-12954 relates to an AMD Platform Security Processor (ASP) boot loader header where improper input and range validation can allow attacker-controlled values before signature verification, potentially enabling arbitrary code execution and bypassing SPI ROM protections to modify SPI ROM. Th...

CVE-2021-26364

CVE-2021-26364 affects a system with insufficient bounds checking in an SMU mailbox register, potentially allowing reading beyond the SRAM address range and triggering an exception handling path that could cause a denial of service. The description in the CVE notes this could occur locally and co...

CVE-2021-26408

The CVE-2021-26408 issue affects AMD SEV-legacy firmware, where insufficient validation of elliptic curve points during SEV-legacy guest migration could lead to loss of guest integrity or confidentiality. This is rooted in inadequate point validation within SEV-legacy firmware. According to the c...

CVE-2021-26373

CVE-2021-26373 involves insufficient bound checks in the System Management Unit (SMU) that can cause a system voltage malfunction and potentially deny resources or service. The connected advisories (SUSE kernel-firmware updates SUSE-SU-2022:1840/1846/1923 and related OpenVAS entries) indicate thi...

CVE-2021-26370

Summary: CVE-2021-26370 describes an improper validation of the destination address in AMD EPYC UApp/ABL handling via SVC_LOAD_FW_IMAGE_BY_INSTANCE and SVC_LOAD_BINARY_BY_ATTRIB. Affected product/area: AMD EPYC server processors featuring UApp/ABL (as described in related sources). The issue conc...

CVE-2021-26312

CVE-2021-26312 is addressed in SUSE kernel-firmware updates. The advisory notes that failure to flush the IOMMU TLB may allow an IO device to access memory it should not, potentially compromising integrity. SUSE’s fixes update kernel-firmware to versions 20220411 (AMD microcode updates) and 20220...

CVE-2023-20521

CVE-2023-20521 describes a TOCTOU flaw in the AMD ASP Bootloader that could let an attacker with physical access tamper SPI ROM records after memory verification, risking confidentiality loss and potential DoS. Connected sources (SUSE kernel-firmware updates and AMD/SUSe advisories) confirm this ...

CVE-2021-26335

CVE-2021-26335 concerns the AMD Secure Processor (ASP) boot loader image header. The issue is improper input and range checking, enabling attacker-controlled values before signature validation and potentially allowing arbitrary code execution. In NVD/AMD documentation, the vulnerability is listed...

CVE-2021-26354

CVE-2021-26354 affects AMD’s ASP/Bootloader pathway (ASP/ABL) with Insufficient bounds checking that may allow a system call from a compromised ABL, initializing arbitrary memory to zero and potentially compromising integrity. The vulnerability is documented across multiple sources (NVD entry and...

CVE-2021-26371

The CVE-2021-26371 entry concerns AMD Secure Processor (ASP)/AMD System Management Unit (SMU) where a compromised ABL or UApp could trigger a SHA256 system call to the bootloader, potentially exposing ASP memory to userspace and causing information disclosure. Technical details from connected sou...

CVE-2021-26398

CVE-2021-26398 affects the AMD Secure Processor (ASP) via insufficient input validation in SYS_KEY_DERIVE. A compromised user application or ABL may corrupt ASP OS memory, potentially enabling arbitrary code execution. Public details identify the vulnerability and associated risk to ASP/firmware,...

CVE-2021-26345

CVE-2021-26345 is an AMD ASP/firmware vulnerability where failure to validate the APCB value may allow a privileged attacker with physical access to tamper with the APCB token, forcing an out-of-bounds memory read and potentially causing a denial of service. Public details across SUSE OSV entries...

CVE-2021-26402

CVE-2021-26402 describes insufficient bounds checking in the AMD Secure Processor (ASP) firmware during BIOS mailbox handling, enabling an attacker to write partially controlled data out-of-bounds into SMM or SEV-ES regions and potentially compromise integrity and availability. The issue is discu...

CVE-2020-12946

CVE-2020-12946 affects AMD’s Platform Security Processor (ASP) firmware, where insufficient input validation for discrete TPM commands could cause loss of integrity and denial of service. The issue is discussed in AMD/SUZE bulletins and is addressed by updating to specific AGESA PI software versi...

CVE-2021-26336

CVE-2021-26336 concerns AMD System Management Unit (SMU) with insufficient bounds checking that can cause invalid memory accesses/updates, leading to an SMU hang and the system may fail to service further requests from other components. Multiple sources confirm the issue under the SMU and referen...

CVE-2020-12988

CVE-2020-12988 affects AMD EPYC platforms (1st–3rd Gen) per AMD-SB-1021. The DoS issue is described as a hang during system reboot in the integrated chipset/AMD platform components (e.g., ASP/SMU/SEV family). Affected products include 1st Gen EPYC (Naples), 2nd Gen (Rome), and 3rd Gen (Milan) CPU...

CVE-2020-12944

CVE-2020-12944 affects AMD Secure Processor (ASP) firmware, where insufficient validation of BIOS image length could allow arbitrary code execution. AMD documentation (AMD-SB-1027/1021) lists affected platforms across desktop, mobile and server AMD systems and provides mitigations via AGESA PI fi...

CVE-2023-20533

CVE-2023-20533 is documented in multiple trusted sources as a vulnerability in the AMD SMU/ASP ecosystem: it describes insufficient DRAM address validation in the System Management Unit (SMU), which may allow a DMA attacker to read/write invalid DRAM addresses and could lead to denial of service....

CVE-2023-20527

CVE-2023-20527 concerns the AMD Secure Processor (ASP) Bootloader. The issue is an improper syscall input validation in the Bootloader, which may allow a privileged attacker to read memory out-of-bounds, potentially causing a denial-of-service. The CVSS v3.1 metrics indicate Network attack vector...

CVE-2021-26356

CVE-2021-26356 describes a TOCTOU vulnerability in the ASP bootloader that can allow tampering with the SPI ROM after memory reads, potentially causing S3 data corruption and information disclosure in AMD Secure Processor/ASP boot scenarios. Affected components include the ASP bootloader within A...

CVE-2021-26344

CVE-2021-26344 is an out-of-bounds memory write in the AMD PSP1 Configuration Block (APCB) processing that could let an attacker with BIOS access modify the BIOS image and sign the result, potentially corrupting APCB and enabling arbitrary code execution. Connected sources (AMD AMD-SB-3003/AMD-SB...

CVE-2023-20529

The CVE-2023-20529 issue affects the AMD System Management Unit (SMU) , where insufficient bound checks can allow an attacker to update the sender/receiver address space to an invalid value, potentially causing a denial of service. The vulnerability is tied to SMU/firmware handling and is documen...

CVE-2021-46774

CVE-2021-46774 describes insufficient input validation in the AMD ABL, enabling a privileged attacker to perform arbitrary DRAM writes and potentially execute code or escalate privileges. Connected advisories confirm this vulnerability is among issues addressed by AMD/PI firmware updates and kern...

CVE-2023-20525

The CVE-2023-20525 issue affects the AMD Secure Processor (ASP) Bootloader: it is caused by insufficient syscall input validation that can allow a privileged attacker to read memory outside mapped register bounds, potentially causing a denial of service. Public details identify the affected compo...

CVE-2023-20531

CVE-2023-20531 affects the AMD System Management Unit (SMU) in AMD EPYC platforms. The root cause is insufficient bound checks in SMU, allowing an attacker to update SRAM between address spaces to an invalid value, which can lead to a denial of service. Connected documents provide concrete detail...

CVE-2020-12951

CVE-2020-12951 describes a race condition in the AMD Platform Security Processor (ASP) firmware that could allow less-privileged x86 code to perform ASP SMM operations. Connected sources confirm this vulnerability and tie it to AMD ASP/SMU firmware, with AMD advisories indicating mitigations via ...

CVE-2021-26403

CVE-2021-26403 corresponds to an AMD SEV vulnerability: insufficient checks in SEV could allow a malicious hypervisor to disclose the launch secret, risking VM confidentiality. Documented impact: local attacker with low privileges could compromise confidentiality; exploit details are not provided...

CVE-2023-20523

CVE-2023-20523 concerns TOCTOU in the AMD Secure Processor (ASP) that may allow a physical attacker to write beyond buffer bounds, potentially causing loss of integrity or denial of service. The issue is documented across multiple sources (NVD/NCSC/Dell AMD bulletins) with the ASP as the affected...

CVE-2021-26338

The CVE targets AMD's System Management Unit (SMU) in AMD EPYC processors (1st–3rd Gen) where improper access controls may allow an attacker to override DRAM performance-control tables, risking resource exhaustion. Affected components/versions are stated in AMD’s bulletin AMD-SB-1021 (AGESA mitig...

CVE-2023-20528

CVE-2023-20528 concerns the AMD System Management Unit (SMU) . The issue is caused by insufficient input validation in the SMU firmware , which could let a physical attacker exfiltrate SMU memory contents via the I2C bus, potentially resulting in a loss of confidentiality. Affected product scope ...

CVE-2023-20578

CVE-2023-20578 describes a TOCTOU in SMM that could allow a ring-0 attacker with BIOS menu/UEFI shell access to modify a communications buffer and potentially execute arbitrary code. Connected documents confirm this vulnerability in the AMD Secure Processor (ASP) / Platform Initialization (PI) co...

CVE-2021-26329

CVE-2021-26329 affects the AMD System Management Unit (SMU). The available documents confirm an integer overflow when an invalid length is provided, potentially causing resource loss. The issue is listed for multiple AMD EPYC generations (1st/2nd/3rd Gen) in AMD’s SB-1021 bulletin. Mitigations in...

CVE-2021-26337

The CVE-2021-26337 issue is an AMD SMU (System Management Unit) DRAM address validation flaw. It can permit a DMA read from an invalid DRAM address into SRAM, causing the SMU to stop servicing further requests. Mitigations are provided by AMD/AGSIA: update to the specified AGESA PI software versi...

CVE-2023-20526

CVE-2023-20526 affects the AMD ASP Bootloader (ASP) within AMD EPYC Embedded platforms. The issue is insufficient input validation in the ASP Bootloader, which could allow a privileged attacker with physical access to expose ASP memory contents and potentially breach confidentiality. Industry adv...

CVE-2021-26331

CVE-2021-26331 affects the AMD System Management Unit (SMU). The vulnerability description indicates a malicious user could manipulate mailbox entries to achieve arbitrary code execution. Impact and exploit details are not provided beyond this, but the AMD-SB-1021 bulletin notes mitigations via O...

CVE-2023-20532

CVE-2023-20532 describes insufficient input validation in the AMD System Management Unit (SMU) that may allow an attacker to lock resources and cause a denial of service. Connected AMD documentation confirms the vulnerability affects SMU components and provides mitigations in the AMD-SB-1032 bull...

CVE-2021-26320

Technical details about CVE-2021-26320 are not publicly available in the provided connected documents; monitor for updates.

CVE-2021-26322

CVE-2021-26322 describes a vulnerability where the persistent platform private key may not be protected with a random IV, enabling a potential two-time pad attack. Affected hardware/firmware per provided documents: AMD Secure Processor (ASP) and AMD EPYC platform components across 1st–3rd Gen EPY...

CVE-2021-26379

CVE-2021-26379 concerns the AMD System Management Unit (SMU) and related AMD Secure Processor (ASP) firmware. The documented issue is insufficient input validation of mailbox data in the SMU, which may allow an attacker to coerc e the SMU to corrupt SMRAM, potentially causing a loss of integrity ...

CVE-2020-12961

CVE-2020-12961 affects AMD Platform Security Processor (PSP). The issue could allow an attacker to zero a privileged register on the System Management Network, potentially bypassing SPI ROM protections. Documented impact is high (CVSSv3.1: 7.8 Local, High impact) with local access and no user int...

CVE-2021-26330

CVE-2021-26330 describes a heap-based overflow in the AMD System Management Unit (SMU) that may result in resource loss. Connected sources confirm affected hardware as AMD EPYC generations (1st/2nd/3rd Gen) and associate the issue with SMU/ASP components. The AMD Bulletin AMD-SB-1021 provides mit...

CVE-2021-26321

CVE-2021-26321 corresponds to an insufficient ID command validation in the AMD SEV Firmware that can allow a local authenticated attacker to cause a denial of service of the Platform Security Processor (PSP). The vulnerability affects AMD EPYC platforms (1st–3rd Gen) with SEV/ASP components; the ...