What is CVE-2021-26315?

CVE-2021-26315 is a high-severity vulnerability in Amd 3rd Gen Epyc™, classified under Insufficient Verification of Data Authenticity. CVSS score: 7.8/10. Published 2021-11-16.

How severe is CVE-2021-26315?

High severity. CVSS v3 base score is 7.8 out of 10.

Vulnerability in Amd 3rd Gen Epyc™

CVE-2021-26315

When the AMD Platform Security Processor (PSP) boot rom loads, authenticates, and subsequently decrypts an encrypted FW, due to insufficient verification of the integrity of decrypted image, arbitrary code may be executed in the PSP when e…

EPSS: 0.002 (5.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Amd 3rd Gen Epyc™ — versions unspecified
Amd Epyc_7003
Amd Epyc_7003_firmware
Amd Epyc_72f3
Amd Epyc_72f3_firmware
Amd Epyc_7313
Amd Epyc_7313_firmware
Amd Epyc_7313p
Amd Epyc_7313p_firmware
Amd Epyc_7343

Weakness classification (CWE)

CWE-345 — Insufficient Verification of Data Authenticity

References

psirt@amd.com (x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2021-26315?: CVE-2021-26315 is a high-severity vulnerability in Amd 3rd Gen Epyc™, classified under Insufficient Verification of Data Authenticity. CVSS score: 7.8/10. Published 2021-11-16.
How severe is CVE-2021-26315?: High severity. CVSS v3 base score is 7.8 out of 10.