CVE-2023-20569

CVE-2023-20569 concerns a side-channel vulnerability in some AMD CPUs where an attacker may influence the return-address predictor, enabling speculative execution at attacker-controlled addresses and potential information disclosure. The vulnerability is discussed across multiple connected source...

CVE-2022-23821

CVE-2022-23821 describes an improper access control in AMD System Management Mode (SMM) that could allow an attacker to write to SPI ROM and potentially achieve arbitrary code execution. Connected sources indicate this affects AMD ASP/SMM components and is mitigated by Platform Initialization (PI...

CVE-2021-26316

CVE-2021-26316 describes a BIOS-level input/communication buffer validation flaw in AMD platforms that may allow a local attacker with low privileges to tamper BIOS buffers and trigger SMM (System Management Mode) arbitrary code execution. Connected sources confirm the root cause is inadequate va...

CVE-2021-26376

CVE-2021-26376 is referenced across multiple SUSE kernel-firmware advisories (SUSE-SU-2022-1840/1846/1847-1, etc.) as part of a family of SMU flaws. The description in the CVE entry states that insufficient checks in the System Management Unit (SMU) FeatureConfig may reenforce features and cause ...

CVE-2021-26375

Technical details for CVE-2021-26375 are not publicly provided in the supplied documents; no affected products, exploit vectors, or fixes are stated here. Monitor for updates from the listed advisories.

CVE-2021-26388

CVE-2021-26388 matches the initial description: improper validation of the BIOS directory can cause reads beyond the RAM directory table, exposing out-of-bounds memory and potentially causing a denial of service. Connected advisories (SUSE-SU-2022:1840-1, 1846-1, 1847-1) reference this CVE as par...

CVE-2021-26378

CVE-2021-26378 is an SMU (System Management Unit) bound-check issue that can cause denial of service by exposing invalid address space. The descriptor in the initial document states only a bound-check deficiency in the SMU leading to DoS, with CVSS v3.1 base score 5.5 (Local, Low privileges requi...

CVE-2021-26346

CVE-2021-26346 affects AMD Secure Processor (ASP) bootloader: failure to validate the integer operand can enable an integer overflow in the L2 directory table in SPI flash, leading to potential denial of service. Affected by several AMD/industry advisories; mitigation requires firmware/BIOS updat...

CVE-2020-12930

CVE-2020-12930 is an AMD ASP/PSP driver vulnerability described as improper parameter handling that could allow a privileged attacker to elevate privileges, potentially compromising integrity. The AMD security bulletin AMD-SB-5001 maps this CVE to various AMD Embedded/ Ryzen platforms and provide...

CVE-2021-26373

CVE-2021-26373 involves insufficient bound checks in the System Management Unit (SMU) that can cause a system voltage malfunction and potentially deny resources or service. The connected advisories (SUSE kernel-firmware updates SUSE-SU-2022:1840/1846/1923 and related OpenVAS entries) indicate thi...

CVE-2023-20597

CVE-2023-20597 concerns improper initialization of variables in the AMD DXE driver, leading to potential local-information disclosure. The vulnerability is discussed across multiple sources (AMD/SB-4007 and related advisories), which describe memory-leak risks in the DXE driver and note mitigatio...

CVE-2023-20555

CVE-2023-20555 is an AMD SMM memory corruption flaw due to insufficient input validation in CpmDisplayFeatureSmm, allowing an attacker to overwrite an arbitrary bit in an attacker-controlled pointer and potentially execute code in SMM. Connected sources indicate this affects AMD processors with S...

CVE-2021-26354

CVE-2021-26354 affects AMD’s ASP/Bootloader pathway (ASP/ABL) with Insufficient bounds checking that may allow a system call from a compromised ABL, initializing arbitrary memory to zero and potentially compromising integrity. The vulnerability is documented across multiple sources (NVD entry and...

CVE-2021-26371

The CVE-2021-26371 entry concerns AMD Secure Processor (ASP)/AMD System Management Unit (SMU) where a compromised ABL or UApp could trigger a SHA256 system call to the bootloader, potentially exposing ASP memory to userspace and causing information disclosure. Technical details from connected sou...

CVE-2022-23820

CVE-2022-23820 corresponds to a vulnerability in AMD ASP/PSP/SMM handling where failure to validate the AMD SMM communication buffer could allow an attacker to corrupt SMRAM and achieve arbitrary code execution. Public details in AMD’s bulletin AMD-SB-5001 confirm the issue and map it to multiple...

CVE-2020-12931

The CVE-2020-12931 issue affects the AMD Secure Processor (ASP) kernel, caused by improper parameter handling, enabling a privileged attacker to elevate privileges and potentially compromise integrity. AMD’s AMD-SB-5001 bulletin maps this vulnerability across ASP/PSP components (ASP kernel) and p...

CVE-2021-26392

CVE-2021-26392 involves insufficient verification of a missing size check in LoadModule, leading to an out-of-bounds write that could enable code execution in the OS/kernel via loading a malicious TA. AMD’s related bulletin (AMD-SB-5001) labels this CVE as Medium and provides mitigations through ...

CVE-2023-20533

CVE-2023-20533 is documented in multiple trusted sources as a vulnerability in the AMD SMU/ASP ecosystem: it describes insufficient DRAM address validation in the System Management Unit (SMU), which may allow a DMA attacker to read/write invalid DRAM addresses and could lead to denial of service....

CVE-2021-26356

CVE-2021-26356 describes a TOCTOU vulnerability in the ASP bootloader that can allow tampering with the SPI ROM after memory reads, potentially causing S3 data corruption and information disclosure in AMD Secure Processor/ASP boot scenarios. Affected components include the ASP bootloader within A...

CVE-2023-20589

The CVE-2023-20589 entry corresponds to a voltage fault injection vulnerability affecting fTPM ASP secure boot on AMD Ryzen platforms (Zen 1/2/3). The AMD-SB-4005 bulletin provides concrete details: potential arbitrary code execution via physical access and specialized hardware, impacting a wide ...

CVE-2021-26365

CVE-2021-26365 concerns AMD Secure Processor (ASP) and AMD System Management Unit (SMU) firmware where certain size values in firmware binary headers can cause out-of-bounds reads during signature validation, potentially enabling denial of service or leakage of memory contents. Public references ...

CVE-2023-20594

CVE-2023-20594 concerns the AMD DXE driver. The root cause is improper initialization of variables in the DXE driver, which may allow a privileged local user to leak sensitive information. Impact is information disclosure with local access; attack vector is local. The vulnerability affects AMD DX...

CVE-2021-46774

CVE-2021-46774 describes insufficient input validation in the AMD ABL, enabling a privileged attacker to perform arbitrary DRAM writes and potentially execute code or escalate privileges. Connected advisories confirm this vulnerability is among issues addressed by AMD/PI firmware updates and kern...