CVE-2023-20569

CVE-2023-20569 concerns a side-channel vulnerability in some AMD CPUs where an attacker may influence the return-address predictor, enabling speculative execution at attacker-controlled addresses and potential information disclosure. The vulnerability is discussed across multiple connected source...

CVE-2022-23821

CVE-2022-23821 describes an improper access control in AMD System Management Mode (SMM) that could allow an attacker to write to SPI ROM and potentially achieve arbitrary code execution. Connected sources indicate this affects AMD ASP/SMM components and is mitigated by Platform Initialization (PI...

CVE-2021-26316

CVE-2021-26316 describes a BIOS-level input/communication buffer validation flaw in AMD platforms that may allow a local attacker with low privileges to tamper BIOS buffers and trigger SMM (System Management Mode) arbitrary code execution. Connected sources confirm the root cause is inadequate va...

CVE-2021-26346

CVE-2021-26346 affects AMD Secure Processor (ASP) bootloader: failure to validate the integer operand can enable an integer overflow in the L2 directory table in SPI flash, leading to potential denial of service. Affected by several AMD/industry advisories; mitigation requires firmware/BIOS updat...

CVE-2020-12930

CVE-2020-12930 is an AMD ASP/PSP driver vulnerability described as improper parameter handling that could allow a privileged attacker to elevate privileges, potentially compromising integrity. The AMD security bulletin AMD-SB-5001 maps this CVE to various AMD Embedded/ Ryzen platforms and provide...

CVE-2023-20555

CVE-2023-20555 is an AMD SMM memory corruption flaw due to insufficient input validation in CpmDisplayFeatureSmm, allowing an attacker to overwrite an arbitrary bit in an attacker-controlled pointer and potentially execute code in SMM. Connected sources indicate this affects AMD processors with S...

CVE-2020-12931

The CVE-2020-12931 issue affects the AMD Secure Processor (ASP) kernel, caused by improper parameter handling, enabling a privileged attacker to elevate privileges and potentially compromise integrity. AMD’s AMD-SB-5001 bulletin maps this vulnerability across ASP/PSP components (ASP kernel) and p...

CVE-2021-26371

The CVE-2021-26371 entry concerns AMD Secure Processor (ASP)/AMD System Management Unit (SMU) where a compromised ABL or UApp could trigger a SHA256 system call to the bootloader, potentially exposing ASP memory to userspace and causing information disclosure. Technical details from connected sou...

CVE-2021-26354

CVE-2021-26354 affects AMD’s ASP/Bootloader pathway (ASP/ABL) with Insufficient bounds checking that may allow a system call from a compromised ABL, initializing arbitrary memory to zero and potentially compromising integrity. The vulnerability is documented across multiple sources (NVD entry and...

CVE-2022-23820

CVE-2022-23820 corresponds to a vulnerability in AMD ASP/PSP/SMM handling where failure to validate the AMD SMM communication buffer could allow an attacker to corrupt SMRAM and achieve arbitrary code execution. Public details in AMD’s bulletin AMD-SB-5001 confirm the issue and map it to multiple...

CVE-2021-26392

CVE-2021-26392 involves insufficient verification of a missing size check in LoadModule, leading to an out-of-bounds write that could enable code execution in the OS/kernel via loading a malicious TA. AMD’s related bulletin (AMD-SB-5001) labels this CVE as Medium and provides mitigations through ...

CVE-2023-20533

CVE-2023-20533 is documented in multiple trusted sources as a vulnerability in the AMD SMU/ASP ecosystem: it describes insufficient DRAM address validation in the System Management Unit (SMU), which may allow a DMA attacker to read/write invalid DRAM addresses and could lead to denial of service....

CVE-2021-26365

CVE-2021-26365 concerns AMD Secure Processor (ASP) and AMD System Management Unit (SMU) firmware where certain size values in firmware binary headers can cause out-of-bounds reads during signature validation, potentially enabling denial of service or leakage of memory contents. Public references ...

CVE-2021-46774

CVE-2021-46774 describes insufficient input validation in the AMD ABL, enabling a privileged attacker to perform arbitrary DRAM writes and potentially execute code or escalate privileges. Connected advisories confirm this vulnerability is among issues addressed by AMD/PI firmware updates and kern...

CVE-2021-26356

CVE-2021-26356 describes a TOCTOU vulnerability in the ASP bootloader that can allow tampering with the SPI ROM after memory reads, potentially causing S3 data corruption and information disclosure in AMD Secure Processor/ASP boot scenarios. Affected components include the ASP bootloader within A...

CVE-2023-20589

The CVE-2023-20589 entry corresponds to a voltage fault injection vulnerability affecting fTPM ASP secure boot on AMD Ryzen platforms (Zen 1/2/3). The AMD-SB-4005 bulletin provides concrete details: potential arbitrary code execution via physical access and specialized hardware, impacting a wide ...