Improper input validation in Amd 2nd Gen Epyc™
CVE-2020-12961
A potential vulnerability exists in AMD Platform Security Processor (PSP) that may allow an attacker to zero any privileged register on the System Management Network which may lead to bypassing SPI ROM protections.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.002 (15.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Amd 2nd Gen Epyc™ — versions unspecified
- Amd 3rd Gen Epyc™ — versions unspecified
- Amd Epyc_7002
- Amd Epyc_7002_firmware
- Amd Epyc_7003
- Amd Epyc_7003_firmware
- Amd Epyc_7232p
- Amd Epyc_7232p_firmware
- Amd Epyc_7252
- Amd Epyc_7252_firmware
Weakness classification (CWE)
References
- psirt@amd.com (x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2020-12961?
- CVE-2020-12961 is a high-severity vulnerability in Amd 2nd Gen Epyc™, classified under Improper Input Validation. CVSS score: 7.8/10. Published 2021-11-16.
- How severe is CVE-2020-12961?
- High severity. CVSS v3 base score is 7.8 out of 10.