CVE-2023-20569

CVE-2023-20569 concerns a side-channel vulnerability in some AMD CPUs where an attacker may influence the return-address predictor, enabling speculative execution at attacker-controlled addresses and potential information disclosure. The vulnerability is discussed across multiple connected source...

CVE-2023-4969

CVE-2023-4969 describes a vulnerability where a GPU kernel can read sensitive data from another GPU kernel through the local memory region across various architectures. The issue is a confidentiality exposure (HIGH) with LOCAL access and LOW attack complexity; no user interaction is required. The...

CVE-2023-20558

CVE-2023-20558 involves AMD Secure Processor/SMU SMM code. The root cause is insufficient control flow management in AmdCpmOemSmm, which could allow a privileged attacker to tamper with the SMM handler and escalate privileges. Affected software/hardware: AMD Ryzen 2000 series desktop processors (...

CVE-2021-26316

CVE-2021-26316 describes a BIOS-level input/communication buffer validation flaw in AMD platforms that may allow a local attacker with low privileges to tamper BIOS buffers and trigger SMM (System Management Mode) arbitrary code execution. Connected sources confirm the root cause is inadequate va...

CVE-2023-20579

CVE-2023-20579 involves improper access control in the AMD SPI protection feature. A local Ring0 (kernel mode) user could bypass protections, potentially affecting integrity and availability. Connected documents confirm this is an AMD SPI protection flaw and cite multiple advisories (NVD, Red Hat...

CVE-2021-26376

CVE-2021-26376 is referenced across multiple SUSE kernel-firmware advisories (SUSE-SU-2022-1840/1846/1847-1, etc.) as part of a family of SMU flaws. The description in the CVE entry states that insufficient checks in the System Management Unit (SMU) FeatureConfig may reenforce features and cause ...

CVE-2021-26382

CVE-2021-26382 affects AMD ACP firmware image validation: an attacker with root privileges can load any legitimately signed firmware image into the Audio Co-Processor, bypassing key restrictions and potentially causing a denial of service. Affected platforms span AMD Ryzen desktop/mobile families...

CVE-2021-26346

CVE-2021-26346 affects AMD Secure Processor (ASP) bootloader: failure to validate the integer operand can enable an integer overflow in the L2 directory table in SPI flash, leading to potential denial of service. Affected by several AMD/industry advisories; mitigation requires firmware/BIOS updat...

CVE-2021-26375

Technical details for CVE-2021-26375 are not publicly provided in the supplied documents; no affected products, exploit vectors, or fixes are stated here. Monitor for updates from the listed advisories.

CVE-2021-26390

CVE-2021-26390 affects AMD’s boot flow (UApp/ABL) where a malicious or compromised UApp/ABL can coerce the bootloader to corrupt arbitrary memory, potentially compromising data integrity. The vulnerability is tracked across AMD client and server platforms (ASP/SMU/bootloader chain) with a medium ...

CVE-2020-12930

CVE-2020-12930 is an AMD ASP/PSP driver vulnerability described as improper parameter handling that could allow a privileged attacker to elevate privileges, potentially compromising integrity. The AMD security bulletin AMD-SB-5001 maps this CVE to various AMD Embedded/ Ryzen platforms and provide...

CVE-2021-26388

CVE-2021-26388 matches the initial description: improper validation of the BIOS directory can cause reads beyond the RAM directory table, exposing out-of-bounds memory and potentially causing a denial of service. Connected advisories (SUSE-SU-2022:1840-1, 1846-1, 1847-1) reference this CVE as par...

CVE-2023-20597

CVE-2023-20597 concerns improper initialization of variables in the AMD DXE driver, leading to potential local-information disclosure. The vulnerability is discussed across multiple sources (AMD/SB-4007 and related advisories), which describe memory-leak risks in the DXE driver and note mitigatio...

CVE-2023-20555

CVE-2023-20555 is an AMD SMM memory corruption flaw due to insufficient input validation in CpmDisplayFeatureSmm, allowing an attacker to overwrite an arbitrary bit in an attacker-controlled pointer and potentially execute code in SMM. Connected sources indicate this affects AMD processors with S...

CVE-2021-26378

CVE-2021-26378 is an SMU (System Management Unit) bound-check issue that can cause denial of service by exposing invalid address space. The descriptor in the initial document states only a bound-check deficiency in the SMU leading to DoS, with CVSS v3.1 base score 5.5 (Local, Low privileges requi...

CVE-2021-26393

CVE-2021-26393 describes insufficient memory cleanup in the AMD Secure Processor (ASP) TEE, which could allow an authenticated user with privileges to generate a valid signed TA and potentially poison process memory, leading to confidentiality loss. The connected AMD security bulletin (AMD-SB-500...

CVE-2020-12931

The CVE-2020-12931 issue affects the AMD Secure Processor (ASP) kernel, caused by improper parameter handling, enabling a privileged attacker to elevate privileges and potentially compromise integrity. AMD’s AMD-SB-5001 bulletin maps this vulnerability across ASP/PSP components (ASP kernel) and p...

CVE-2023-20596

CVE-2023-20596 involves improper input validation in the AMD SMM Supervisor. A compromised SMI handler could gain Ring0 and potentially execute arbitrary code. Documents show affected AMD platforms across Desktop, Mobile, and Embedded lines, with mitigations delivered via OEM firmware updates (e....

CVE-2021-26373

CVE-2021-26373 involves insufficient bound checks in the System Management Unit (SMU) that can cause a system voltage malfunction and potentially deny resources or service. The connected advisories (SUSE kernel-firmware updates SUSE-SU-2022:1840/1846/1923 and related OpenVAS entries) indicate thi...

CVE-2021-26354

CVE-2021-26354 affects AMD’s ASP/Bootloader pathway (ASP/ABL) with Insufficient bounds checking that may allow a system call from a compromised ABL, initializing arbitrary memory to zero and potentially compromising integrity. The vulnerability is documented across multiple sources (NVD entry and...

CVE-2021-26384

CVE-2021-26384 is a vulnerability described as a malformed System Management Interface (SMI) command that can corrupt the SMI Trigger Info data structure, potentially enabling out-of-bounds memory reads/writes when an SMI is triggered. The AMD ADM/AMD-SB-1027 bulletin lists this CVE among others ...

CVE-2023-20589

The CVE-2023-20589 entry corresponds to a voltage fault injection vulnerability affecting fTPM ASP secure boot on AMD Ryzen platforms (Zen 1/2/3). The AMD-SB-4005 bulletin provides concrete details: potential arbitrary code execution via physical access and specialized hardware, impacting a wide ...

CVE-2021-26352

CVE-2021-26352 corresponds to an AMD SMU issue where insufficient bound checks in the System Management Unit (SMU) PCIe Hot Plug table can allow access/updates to invalid address space, potentially causing a denial of service. Connected AMD bulletin documents (AMD-SB-1027/AMD-SB-1021) list this C...

CVE-2021-46778

CVE-2021-46778 describes an information-disclosure side-channel vulnerability in AMD CPUs with SMT (Zen 1–Zen 4). The root cause is execution unit scheduler contention on SMT-enabled cores, allowing an attacker to infer data by measuring scheduler-queue contention. Public documents identify affec...

CVE-2023-20563

CVE-2023-20563 is a documented AMD/PI firmware vulnerability affecting System Management Mode (SMM) with local privilege escalation potential. The Connected AMD bulletin entries (AMD-SB-5001 and AMD-SB-4002) describe multiple affected AMD embedded platforms and indicate mitigations via Platform I...

CVE-2021-26367

CVE-2021-26367 describes a vulnerability where an attacker with local access could cause a misconfiguration of the Trusted Memory Regions (TMRs) on AMD platforms with AMD Secure Processor (ASP). The root cause is misconfiguration of TMR address ranges, potentially enabling an attacker to set an a...

CVE-2021-26391

CVE-2021-26391 affects AMD firmware/TPM-like trust environment: insufficient verification of multiple header signatures when loading a Trusted Application (TA) may allow a privileged attacker to gain code execution in the TA or OS/kernel. AMD-SB-4001 lists this CVE as Medium severity and provides...

CVE-2023-20559

The CVE-2023-20559 entry concerns AMD Ryzen 2000-series CPUs with a vulnerability in the System Management Mode (SMM) component. Specifically, insufficient control flow management in AmdCpmGpioInitSmm could allow a privileged attacker to tamper with the SMM handler, potentially leading to privile...

CVE-2023-20594

CVE-2023-20594 concerns the AMD DXE driver. The root cause is improper initialization of variables in the DXE driver, which may allow a privileged local user to leak sensitive information. Impact is information disclosure with local access; attack vector is local. The vulnerability affects AMD DX...

CVE-2021-26392

CVE-2021-26392 involves insufficient verification of a missing size check in LoadModule, leading to an out-of-bounds write that could enable code execution in the OS/kernel via loading a malicious TA. AMD’s related bulletin (AMD-SB-5001) labels this CVE as Medium and provides mitigations through ...

CVE-2021-46758

CVE-2021-46758 involves insufficient validation of SPI flash addresses in the AMD Secure Processor (ASP) bootloader. The issue may allow an attacker to read data mapped beyond SPI flash, potentially impacting availability and integrity. Related documents confirm the vulnerability in ASP bootloade...

CVE-2021-26365

CVE-2021-26365 concerns AMD Secure Processor (ASP) and AMD System Management Unit (SMU) firmware where certain size values in firmware binary headers can cause out-of-bounds reads during signature validation, potentially enabling denial of service or leakage of memory contents. Public references ...

CVE-2023-20571

CVE-2023-20571 describes a race condition in AMD System Management Mode (SMM) code that, if exploited by a compromised user-space process, could facilitate privilege escalation by leveraging CVE-2018-8897. The connected AMD advisories confirm this issue under AMD SB-5001/AMD SB-4002 families with...

CVE-2023-20565

CVE-2023-20565 is documented in AMD’s embedded/PI firmware advisories (AMD-SB-5001 and related) as a high-severity issue where insufficient protections in System Management Mode (SMM) could allow privilege escalation via local access. The connected AMD bulletin provides mitigations via Platform I...