Amd
Page 4 of 5 — Amd CVEs from a corpus of 463, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-23818 | High | 7.5 | 2023-05-09 | Insufficient input validation on the model specific register: VM_HSAVE_PA may potentially lead to loss of SEV-SNP guest memory integrity. … |
CVE-2021-46775 | Medium | 6.8 | 2023-05-09 | Improper input validation in ABL may enable an attacker with physical access, to perform arbitrary memory overwrites, potentially leading to a loss of integrit… |
CVE-2021-46769 | High | 8.8 | 2023-05-09 | Insufficient syscall input validation in the ASP Bootloader may allow a privileged attacker to execute arbitrary DMA copies, which can lead to code execution… |
CVE-2021-46764 | High | 7.5 | 2023-05-09 | Improper validation of DRAM addresses in SMU may allow an attacker to overwrite sensitive memory locations within the ASP potentially resulting in a denial of… |
CVE-2021-46763 | High | 7.5 | 2023-05-09 | Insufficient input validation in the SMU may enable a privileged attacker to write beyond the intended bounds of a shared memory buffer potentially leading to… |
CVE-2021-46762 | Low | 3.9 | 2023-05-09 | Insufficient input validation in the SMU may allow an attacker to corrupt SMU SRAM potentially leading to a loss of integrity or denial of service. |
CVE-2021-46753 | Critical | 9.1 | 2023-05-09 | Failure to validate the length fields of the ASP (AMD Secure Processor) sensor fusion hub headers may allow an attacker with a malicious Uapp or ABL to map the… |
CVE-2021-46749 | High | 7.5 | 2023-05-09 | Insufficient bounds checking in ASP (AMD Secure Processor) may allow for an out of bounds read in SMI (System Management Interface) mailbox checksum calculatio… |
CVE-2021-26406 | High | 7.5 | 2023-05-09 | Insufficient validation in parsing Owner's Certificate Authority (OCA) certificates in SEV (AMD Secure Encrypted Virtualization) and SEV-ES user application ca… |
CVE-2021-26397 | High | 7.1 | 2023-05-09 | Insufficient address validation, may allow an attacker with a compromised ABL and UApp to corrupt sensitive memory locations potentially resulting in a loss of… |
CVE-2021-26379 | Critical | 9.8 | 2023-05-09 | Insufficient input validation of mailbox data in the SMU may allow an attacker to coerce the SMU to corrupt SMRAM, potentially leading to a loss of integrity a… |
CVE-2021-26371 | Medium | 5.5 | 2023-05-09 | A compromised or malicious ABL or UApp could send a SHA256 system call to the bootloader, which may result in exposure of ASP memory to userspace, potentially… |
CVE-2021-26365 | High | 8.2 | 2023-05-09 | Certain size values in firmware binary headers could trigger out of bounds reads during signature validation, leading to denial of service or potentially limit… |
CVE-2021-26356 | High | 7.4 | 2023-05-09 | A TOCTOU in ASP bootloader may allow an attacker to tamper with the SPI ROM following data read to memory potentially resulting in S3 data corruption and infor… |
CVE-2021-26354 | Medium | 5.5 | 2023-05-09 | Insufficient bounds checking in ASP may allow an attacker to issue a system call from a compromised ABL which may cause arbitrary memory values to be initializ… |
CVE-2023-20559 | High | 8.8 | 2023-04-02 | Insufficient control flow management in AmdCpmGpioInitSmm may allow a privileged attacker to tamper with the SMM handler potentially leading to escalation o… |
CVE-2023-20558 | High | 8.8 | 2023-04-02 | Insufficient control flow management in AmdCpmOemSmm may allow a privileged attacker to tamper with the SMM handler potentially leading to an escalation of pr… |
CVE-2022-27677 | High | 7.8 | 2023-03-01 | Failure to validate privileges during installation of AMD Ryzen™ Master may allow an attacker with low privileges to modify files potentially leading to privi… |
CVE-2022-27672 | Medium | 4.7 | 2023-03-01 | When SMT is enabled, certain AMD processors may speculatively execute instructions using a target from the sibling thread after an SMT mode switch potentially… |
CVE-2023-20532 | Medium | 5.3 | 2023-01-11 | Insufficient input validation in the SMU may allow an attacker to improperly lock resources, potentially resulting in a denial of service. |
CVE-2023-20531 | High | 7.5 | 2023-01-11 | Insufficient bound checks in the SMU may allow an attacker to update the SRAM from/to address space to an invalid value potentially resulting in a denial of se… |
CVE-2023-20530 | High | 7.5 | 2023-01-11 | Insufficient input validation of BIOS mailbox messages in SMU may result in out-of-bounds memory reads potentially resulting in a denial of service. |
CVE-2023-20529 | High | 7.5 | 2023-01-11 | Insufficient bound checks in the SMU may allow an attacker to update the from/to address space to an invalid value potentially resulting in a denial of service… |
CVE-2023-20528 | Low | 2.4 | 2023-01-11 | Insufficient input validation in the SMU may allow a physical attacker to exfiltrate SMU memory contents over the I2C bus potentially leading to a loss of conf… |
CVE-2023-20527 | Medium | 6.5 | 2023-01-11 | Improper syscall input validation in the ASP Bootloader may allow a privileged attacker to read memory out-of-bounds, potentially leading to a denial-of-servic… |
CVE-2023-20525 | Medium | 6.5 | 2023-01-11 | Insufficient syscall input validation in the ASP Bootloader may allow a privileged attacker to read memory outside the bounds of a mapped register potentially… |
CVE-2023-20523 | Medium | 5.7 | 2023-01-11 | TOCTOU in the ASP may allow a physical attacker to write beyond the buffer bounds, potentially leading to a loss of integrity or denial of service. |
CVE-2023-20522 | High | 7.5 | 2023-01-11 | Insufficient input validation in ASP may allow an attacker with a malicious BIOS to potentially cause a denial of service. |
CVE-2022-23814 | Medium | 5.3 | 2023-01-11 | Failure to validate addresses provided by software to BIOS commands may result in a potential loss of integrity of guest memory in a confidential compute envir… |
CVE-2022-23813 | Medium | 5.3 | 2023-01-11 | The software interfaces to ASP and SMU may not enforce the SNP memory security policy resulting in a potential loss of integrity of guest memory in a confident… |
CVE-2021-46795 | Medium | 4.7 | 2023-01-11 | A TOCTOU (time-of-check to time-of-use) vulnerability exists where an attacker may use a compromised BIOS to cause the TEE OS to read memory out of bounds that… |
CVE-2021-46791 | Medium | 5.5 | 2023-01-11 | Insufficient input validation during parsing of the System Management Mode (SMM) binary may allow a maliciously crafted SMM executable binary to corrupt Dynami… |
CVE-2021-46779 | High | 7.1 | 2023-01-11 | Insufficient input validation in SVC_ECC_PRIMITIVE system call in a compromised user application or ABL may allow an attacker to corrupt ASP (AMD Secure Proces… |
CVE-2021-46768 | Medium | 5.5 | 2023-01-11 | Insufficient input validation in SEV firmware may allow an attacker to perform out-of-bounds memory reads within the ASP boot loader, potentially leading to a… |
CVE-2021-46767 | Medium | 6.1 | 2023-01-11 | Insufficient input validation in the ASP may allow an attacker with physical access, unauthorized write access to memory potentially leading to a loss of integ… |
CVE-2021-26409 | High | 7.8 | 2023-01-11 | Insufficient bounds checking in SEV-ES may allow an attacker to corrupt Reverse Map table (RMP) memory, potentially resulting in a loss of SNP (Secure Nested P… |
CVE-2021-26407 | Medium | 5.5 | 2023-01-11 | A randomly generated Initialization Vector (IV) may lead to a collision of IVs with the same key potentially resulting in information disclosure. |
CVE-2021-26404 | Medium | 5.5 | 2023-01-11 | Improper input validation and bounds checking in SEV firmware may leak scratch buffer bytes leading to potential information disclosure. |
CVE-2021-26403 | Medium | 6.5 | 2023-01-11 | Insufficient checks in SEV may lead to a malicious hypervisor disclosing the launch secret potentially resulting in compromise of VM confidentiality. |
CVE-2021-26402 | High | 7.1 | 2023-01-11 | Insufficient bounds checking in ASP (AMD Secure Processor) firmware while handling BIOS mailbox commands, may allow an attacker to write partially-controlled d… |
CVE-2021-26398 | High | 7.8 | 2023-01-11 | Insufficient input validation in SYS_KEY_DERIVE system call in a compromised user application or ABL may allow an attacker to corrupt ASP (AMD Secure Processor… |
CVE-2021-26396 | Medium | 4.4 | 2023-01-11 | Insufficient validation of address mapping to IO in ASP (AMD Secure Processor) may result in a loss of memory integrity in the SNP guest. |
CVE-2021-26355 | Medium | 5.5 | 2023-01-11 | Insufficient fencing and checks in System Management Unit (SMU) may result in access to invalid message port registers that could result in a potential denial-… |
CVE-2021-26346 | Medium | 5.5 | 2023-01-11 | Failure to validate the integer operand in ASP (AMD Secure Processor) bootloader may allow an attacker to introduce an integer overflow in the L2 directory tab… |
CVE-2021-26343 | Medium | 5.5 | 2023-01-11 | Insufficient validation in ASP BIOS and DRTM commands may allow malicious supervisor x86 software to disclose the contents of sensitive memory which may result… |
CVE-2021-26328 | Medium | 4.4 | 2023-01-11 | Failure to verify the mode of CPU execution at the time of SNP_INIT may lead to a potential loss of memory integrity for SNP guests. |
CVE-2021-26316 | High | 7.8 | 2023-01-11 | Failure to validate the communication buffer and communication service in the BIOS may allow an attacker to tamper with the buffer resulting in potential SMM (… |
CVE-2022-44643 | Medium | 5.7 | 2022-12-20 | A vulnerability in the label-based access control of Grafana Labs Grafana Enterprise Metrics allows an attacker more access than intended. If an access policy… |
CVE-2022-29277 | High | 8.8 | 2022-11-15 | Incorrect pointer checks within the the FwBlockServiceSmm driver can allow arbitrary RAM modifications During review of the FwBlockServiceSmm driver, certain i… |
CVE-2022-27674 | High | 7.5 | 2022-11-09 | Insufficient validation in the IOCTL input/output buffer in AMD μProf may allow an attacker to bypass bounds checks potentially leading to a Windows kernel cra… |
CVE-2022-27673 | High | 7.5 | 2022-11-09 | Insufficient access controls in the AMD Link Android app may potentially result in information disclosure. |
CVE-2022-23831 | High | 7.5 | 2022-11-09 | Insufficient validation of the IOCTL input buffer in AMD μProf may allow an attacker to send an arbitrary buffer leading to a potential Windows kernel crash re… |
CVE-2022-23824 | Medium | 5.5 | 2022-11-09 | IBPB may not prevent return branch predictions from being specified by pre-IBPB branch targets leading to a potential information disclosure. |
CVE-2021-26393 | Medium | 5.5 | 2022-11-09 | Insufficient memory cleanup in the AMD Secure Processor (ASP) Trusted Execution Environment (TEE) may allow an authenticated attacker with privileges to genera… |
CVE-2021-26392 | High | 7.8 | 2022-11-09 | Insufficient verification of missing size check in 'LoadModule' may lead to an out-of-bounds write potentially allowing an attacker with privileges to gain cod… |
CVE-2021-26391 | High | 7.8 | 2022-11-09 | Insufficient verification of multiple header signatures while loading a Trusted Application (TA) may allow an attacker with privileges to gain code execution i… |
CVE-2021-26360 | High | 7.8 | 2022-11-09 | An attacker with local access to the system can make unauthorized modifications of the security configuration of the SOC registers. This could allow potential… |
CVE-2020-12931 | High | 7.8 | 2022-11-09 | Improper parameters handling in the AMD Secure Processor (ASP) kernel may allow a privileged attacker to elevate their privileges potentially leading to loss o… |
CVE-2020-12930 | High | 7.8 | 2022-11-09 | Improper parameters handling in AMD Secure Processor (ASP) drivers may allow a privileged attacker to elevate their privileges potentially leading to loss of i… |
CVE-2021-46778 | Medium | 5.6 | 2022-08-10 | Execution unit scheduler contention may lead to a side channel vulnerability found on AMD CPU microarchitectures codenamed “Zen 1”, “Zen 2” and “Zen 3” that us… |
CVE-2022-23825 | Medium | 6.5 | 2022-07-14 | Aliases in the branch predictor may cause some AMD processors to predict the wrong branch type potentially leading to information disclosure. |
CVE-2021-26384 | High | 7.8 | 2022-07-14 | A malformed SMI (System Management Interface) command may allow an attacker to establish a corrupted SMI Trigger Info data structure, potentially leading to ou… |
CVE-2021-26382 | Medium | 4.4 | 2022-07-14 | An attacker with root account privileges can load any legitimately signed firmware image into the Audio Co-Processor (ACP,) irrespective of the respective sign… |
CVE-2022-29900 | Medium | 6.5 | 2022-07-12 | Mis-trained branch predictions for return instructions may allow arbitrary speculative code execution under certain microarchitecture-dependent conditions. |
CVE-2022-23823 | Medium | 6.5 | 2022-06-15 | A potential vulnerability in some AMD processors using frequency scaling may allow an authenticated attacker to execute a timing attack to potentially enable i… |
CVE-2021-26386 | High | 7.8 | 2022-05-12 | A malicious or compromised UApp or ABL may be used by an attacker to issue a malformed system call to the Stage 2 Bootloader potentially leading to corrupt mem… |
CVE-2021-26368 | Medium | 4.4 | 2022-05-12 | Insufficient check of the process type in Trusted OS (TOS) may allow an attacker with privileges to enable a lesser privileged process to unmap memory owned by… |
CVE-2021-26363 | Medium | 4.4 | 2022-05-12 | A malicious or compromised UApp or ABL could potentially change the value that the ASP uses for its reserved DRAM, to one outside of the fenced area, potential… |
CVE-2021-26317 | High | 7.8 | 2022-05-12 | Failure to verify the protocol in SMM may allow an attacker to control the protocol and modify SPI flash resulting in a potential arbitrary code execution. |
CVE-2021-26369 | High | 7.8 | 2022-05-12 | A malicious or compromised UApp or ABL may be used by an attacker to send a malformed system call to the bootloader, resulting in out-of-bounds memory accesses. |
CVE-2021-26366 | High | 7.1 | 2022-05-12 | An attacker, who gained elevated privileges via some other vulnerability, may be able to read data from Boot ROM resulting in a loss of system integrity. |
CVE-2021-26362 | High | 7.1 | 2022-05-12 | A malicious or compromised UApp or ABL may be used by an attacker to issue a malformed system call which results in mapping sensitive System Management Network… |
CVE-2021-26361 | Medium | 5.5 | 2022-05-12 | A malicious or compromised User Application (UApp) or AGESA Boot Loader (ABL) could be used by an attacker to exfiltrate arbitrary memory from the ASP stage 2… |
CVE-2021-26351 | Medium | 5.5 | 2022-05-12 | Insufficient DRAM address validation in System Management Unit (SMU) may result in a DMA (Direct Memory Access) read/write from/to invalid DRAM address that co… |
CVE-2021-46744 | Medium | 6.5 | 2022-05-11 | An attacker with access to a malicious hypervisor may be able to infer data values used in a SEV guest on AMD CPUs by monitoring ciphertext values over time. |
CVE-2021-26400 | Medium | 4.0 | 2022-05-11 | AMD processors may speculatively re-order load instructions which can result in stale data being observed when multiple processors are operating on shared memo… |
CVE-2021-26388 | Medium | 5.5 | 2022-05-11 | Improper validation of the BIOS directory may allow for searches to read beyond the directory table copy in RAM, exposing out of bounds memory contents, result… |
CVE-2021-26378 | Medium | 5.5 | 2022-05-11 | Insufficient bound checks in the System Management Unit (SMU) may result in access to an invalid address space that could result in denial of service. |
CVE-2021-26376 | Medium | 5.5 | 2022-05-11 | Insufficient checks in System Management Unit (SMU) FeatureConfig may result in reenabling features potentially resulting in denial of resources and/or denial… |
CVE-2021-26375 | Medium | 5.5 | 2022-05-11 | Insufficient General Purpose IO (GPIO) bounds check in System Management Unit (SMU) may result in access/updates from/to invalid address space that could resul… |
CVE-2021-26373 | Medium | 5.5 | 2022-05-11 | Insufficient bound checks in the System Management Unit (SMU) may result in a system voltage malfunction that could result in denial of resources and/or possib… |
CVE-2021-26372 | Medium | 5.5 | 2022-05-11 | Insufficient bound checks related to PCIE in the System Management Unit (SMU) may result in access to an invalid address space that could result in denial of s… |
CVE-2021-26364 | Medium | 5.5 | 2022-05-11 | Insufficient bounds checking in an SMU mailbox register could allow an attacker to potentially read outside of the SRAM address range which could result in an… |
CVE-2021-26350 | Medium | 4.7 | 2022-05-11 | A TOCTOU race condition in SMU may allow for the caller to obtain and manipulate the address of a message port register which may result in a potential denial… |
CVE-2021-26349 | Medium | 5.5 | 2022-05-11 | Failure to assign a new report ID to an imported guest may potentially result in an SEV-SNP guest VM being tricked into trusting a dishonest Migration Agent (M… |
CVE-2021-26348 | Medium | 5.5 | 2022-05-11 | Failure to flush the Translation Lookaside Buffer (TLB) of the I/O memory management unit (IOMMU) may lead an IO device to write to memory it should not be abl… |
CVE-2021-26347 | Medium | 4.7 | 2022-05-11 | Failure to validate the integer operand in ASP (AMD Secure Processor) bootloader may allow an attacker to introduce an integer overflow in the L2 directory tab… |
CVE-2021-26342 | Low | 3.3 | 2022-05-11 | In SEV guest VMs, the CPU may fail to flush the Translation Lookaside Buffer (TLB) following a particular sequence of operations that includes creation of a ne… |
CVE-2021-26339 | Medium | 5.5 | 2022-05-11 | A bug in AMD CPU’s core logic may allow for an attacker, using specific code from an unprivileged VM, to trigger a CPU core hang resulting in a potential denia… |
CVE-2021-46771 | High | 7.8 | 2022-05-10 | Insufficient validation of addresses in AMD Secure Processor (ASP) firmware system call may potentially lead to arbitrary code execution by a compromised user… |
CVE-2021-26408 | High | 7.1 | 2022-05-10 | Insufficient validation of elliptic curve points in SEV-legacy firmware may compromise SEV-legacy guest migration potentially resulting in loss of guest's inte… |
CVE-2021-26390 | Medium | 6.2 | 2022-05-10 | A malicious or compromised UApp or ABL may coerce the bootloader into corrupting arbitrary memory potentially leading to loss of integrity of data. |
CVE-2021-26370 | High | 7.1 | 2022-05-10 | Improper validation of destination address in SVC_LOAD_FW_IMAGE_BY_INSTANCE and SVC_LOAD_BINARY_BY_ATTRIB in a malicious UApp or ABL may allow an attacker to o… |
CVE-2021-26353 | High | 7.8 | 2022-05-10 | Failure to validate inputs in SMM may allow an attacker to create a mishandled error leaving the DRTM UApp in a partially initialized state potentially resulti… |
CVE-2021-26352 | Medium | 5.5 | 2022-05-10 | Insufficient bound checks in System Management Unit (SMU) PCIe Hot Plug table may result in access/updates from/to invalid address space that could result in d… |
CVE-2021-26332 | High | 7.1 | 2022-05-10 | Failure to verify SEV-ES TMR is not in MMIO space, SEV-ES FW could result in a potential loss of integrity or availability. |
CVE-2021-26324 | High | 7.8 | 2022-05-10 | A bug with the SEV-ES TMR may lead to a potential loss of memory integrity for SNP-active VMs. |
CVE-2021-26401 | Medium | 5.6 | 2022-03-11 | LFENCE/JMP (mitigation V2-2) may not sufficiently mitigate CVE-2017-5715 on some AMD CPUs. |
CVE-2021-26341 | Medium | 6.5 | 2022-03-11 | Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage. |
CVE-2021-39298 | High | 8.8 | 2022-02-16 | A potential vulnerability in AMD System Management Mode (SMM) interrupt handler may allow an attacker with high privileges to access the SMM resulting in arbit… |