Privilege escalation in AMD 2nd Gen Epyc
CVE-2021-39298
A potential vulnerability in AMD System Management Mode (SMM) interrupt handler may allow an attacker with high privileges to access the SMM resulting in arbitrary code execution which could be used by malicious actors to bypass security mechanisms provided in the UEFI firmware.
Vulnerability class: Privilege Escalation
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.004 (31.3th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 31st percentile — 31.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: -0.001
Affected products
- AMD 2nd Gen Epyc — versions Various
- AMD 3rd Gen Epyc — versions various
- AMD Ryzen 2000 Series — versions various
- AMD Ryzen 3000 Series — versions Various
- AMD Ryzen 5000 Series — versions various
- HP 260 G3 Desktop Mini Pc
- HP 260 G3 Desktop Mini Pc Firmware
- HP Elitebook 1050 G1
- HP Elitebook 1050 G1 Firmware
- HP Elitebook 830 G5
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2021-39298?
- CVE-2021-39298 is a high-severity vulnerability in AMD 2nd Gen Epyc, classified under Improper Privilege Management. CVSS score: 8.8/10. Published 2022-02-16.
- How severe is CVE-2021-39298?
- High severity. CVSS v3 base score is 8.8 out of 10.