What is CVE-2021-26342?

CVE-2021-26342 is a low-severity vulnerability in Amd Epyc 7001. CVSS score: 3.3/10. Published 2022-05-11.

How severe is CVE-2021-26342?

Low severity. CVSS v3 base score is 3.3 out of 10.

Vulnerability in Amd Epyc 7001

CVE-2021-26342

In SEV guest VMs, the CPU may fail to flush the Translation Lookaside Buffer (TLB) following a particular sequence of operations that includes creation of a new virtual machine control block (VMCB). The failure to flush the TLB may cause the microcode to use stale TLB translations which may allow for disclosure of SEV guest memory contents. Users of SEV-ES/SEV-SNP guest VMs are not impacted by this vulnerability.

EPSS: 0.002 (12.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 3.3 (Low). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.

Affected products

Amd Epyc_7001
Amd Epyc_7001_firmware
Amd Epyc_7251
Amd Epyc_7251_firmware
Amd Epyc_7261
Amd Epyc_7261_firmware
Amd Epyc_7281
Amd Epyc_7281_firmware
Amd Epyc_72f3
Amd Epyc_72f3_firmware

References

psirt@amd.com (x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2021-26342?: CVE-2021-26342 is a low-severity vulnerability in Amd Epyc 7001. CVSS score: 3.3/10. Published 2022-05-11.
How severe is CVE-2021-26342?: Low severity. CVSS v3 base score is 3.3 out of 10.