CVE-2023-20528

CVE-2023-20528 concerns the AMD System Management Unit (SMU) . The issue is caused by insufficient input validation in the SMU firmware , which could let a physical attacker exfiltrate SMU memory contents via the I2C bus, potentially resulting in a loss of confidentiality. Affected product scope ...

CVE-2023-20578

CVE-2023-20578 describes a TOCTOU in SMM that could allow a ring-0 attacker with BIOS menu/UEFI shell access to modify a communications buffer and potentially execute arbitrary code. Connected documents confirm this vulnerability in the AMD Secure Processor (ASP) / Platform Initialization (PI) co...

CVE-2021-26355

CVE-2021-26355 affects AMD System Management Unit (SMU) in AMD EPYC platform family. The root cause is insufficient fencing and checks in the SMU, which may allow access to invalid message port registers and could lead to a denial-of-service. The AMD security bulletin AMD-SB-1032 documents mitiga...

CVE-2023-20566

CVE-2023-20566: Improper address validation in ASP with SNP enabled may potentially compromise guest memory integrity. In SUSE advisories SUSE-SU-2023:4665-1 and SUSE-SU-2023:4664-1, kernel-firmware updates mitigate this alongside other SNP/SMU-related issues by updating AMD ucode to 20231030 and...

CVE-2021-26329

CVE-2021-26329 affects the AMD System Management Unit (SMU). The available documents confirm an integer overflow when an invalid length is provided, potentially causing resource loss. The issue is listed for multiple AMD EPYC generations (1st/2nd/3rd Gen) in AMD’s SB-1021 bulletin. Mitigations in...

CVE-2021-26331

CVE-2021-26331 affects the AMD System Management Unit (SMU). The vulnerability description indicates a malicious user could manipulate mailbox entries to achieve arbitrary code execution. Impact and exploit details are not provided beyond this, but the AMD-SB-1021 bulletin notes mitigations via O...

CVE-2021-26325

CVE-2021-26325 describes insufficient input validation in the SNP_GUEST_REQUEST command, which may lead to a data abort error and a denial of service. The vulnerability is localized (attack vector: LOCAL) with low attack complexity per NVD CVSS v2/v3 data, and it can impact availability (HIGH in ...

CVE-2023-20526

CVE-2023-20526 affects the AMD ASP Bootloader (ASP) within AMD EPYC Embedded platforms. The issue is insufficient input validation in the ASP Bootloader, which could allow a privileged attacker with physical access to expose ASP memory contents and potentially breach confidentiality. Industry adv...

CVE-2023-20532

CVE-2023-20532 describes insufficient input validation in the AMD System Management Unit (SMU) that may allow an attacker to lock resources and cause a denial of service. Connected AMD documentation confirms the vulnerability affects SMU components and provides mitigations in the AMD-SB-1032 bull...

CVE-2021-26320

Technical details about CVE-2021-26320 are not publicly available in the provided connected documents; monitor for updates.

CVE-2021-26322

CVE-2021-26322 describes a vulnerability where the persistent platform private key may not be protected with a random IV, enabling a potential two-time pad attack. Affected hardware/firmware per provided documents: AMD Secure Processor (ASP) and AMD EPYC platform components across 1st–3rd Gen EPY...

CVE-2022-23830

CVE-2022-23830 affects AMD SNP/SMM scenarios where SMM configuration may not be immutable as intended, potentially causing a limited loss of guest memory integrity. The connected advisories (AMD security bulletins and SUSE kernel-firmware updates) indicate mitigation through firmware updates (PI ...

CVE-2021-26330

CVE-2021-26330 describes a heap-based overflow in the AMD System Management Unit (SMU) that may result in resource loss. Connected sources confirm affected hardware as AMD EPYC generations (1st/2nd/3rd Gen) and associate the issue with SMU/ASP components. The AMD Bulletin AMD-SB-1021 provides mit...

CVE-2021-26379

CVE-2021-26379 concerns the AMD System Management Unit (SMU) and related AMD Secure Processor (ASP) firmware. The documented issue is insufficient input validation of mailbox data in the SMU, which may allow an attacker to coerc e the SMU to corrupt SMRAM, potentially causing a loss of integrity ...

CVE-2021-26323

CVE-2021-26323 relates to an input validation failure in AMD SNP/SEV handling. The issue is described as: failure to validate SEV Commands while SNP is active may impact memory integrity. Affected technology includes AMD Secure Processor components with SEV/SNP, impacting memory integrity (CVE se...

CVE-2021-26397

CVE-2021-26397: Affected AMD components are the AMD Secure Processor (ASP) and the AMD System Management Unit (SMU). The issue is insufficient address validation that can allow a compromised ABL and UApp to corrupt sensitive memory locations, potentially impacting integrity and availability. AMD’...

CVE-2020-12961

CVE-2020-12961 affects AMD Platform Security Processor (PSP). The issue could allow an attacker to zero a privileged register on the System Management Network, potentially bypassing SPI ROM protections. Documented impact is high (CVSSv3.1: 7.8 Local, High impact) with local access and no user int...

CVE-2021-26321

CVE-2021-26321 corresponds to an insufficient ID command validation in the AMD SEV Firmware that can allow a local authenticated attacker to cause a denial of service of the Platform Security Processor (PSP). The vulnerability affects AMD EPYC platforms (1st–3rd Gen) with SEV/ASP components; the ...

CVE-2021-26396

The CVE-2021-26396 issue affects the AMD Secure Processor (ASP) where insufficient validation of address mapping to IO can lead to loss of memory integrity in the SNP guest. The entry is supported by multiple sources (NVD/NCSC AMD SB) detailing the vulnerability and its scope across AMD EPYC gene...

CVE-2021-26327

The CVE-2021-26327 entry concerns AMD SNP Firmware. Affected component: AMD SNP Firmware; root cause: insufficient validation of guest context, leading to potential loss of guest confidentiality. Impact: confidentiality can be partially exposed (per CVSS notes), with local access required. Public...

CVE-2021-26326

CVE-2021-26326 describes a failure to validate VM_HSAVE_PA during SNP_INIT that can compromise memory integrity on AMD platforms. Public details in connected sources indicate the vulnerability affects AMD 3rd Gen EPYC processors (Milan) per the AMD Server Vulnerabilities bulletin AMD-SB-1021, wit...

CVE-2021-26328

CVE-2021-26328 describes a vulnerability in AMD’s Secure Processor/AMD EPYC platform related to SNP_INIT. The issue is a failure to verify the mode of CPU execution during SNP_INIT, which may lead to a potential loss of memory integrity for SNP guests. The AMD security bulletin AMD-SB-1032 docume...