AMD Speculative execution with Floating-Point Value Injection (AMD All supported processors)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.61 % · percentile 49 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- AMD
- NVD status
- Modified
Description
Potential floating point value injection in all supported CPU products, in conjunction with software vulnerabilities relating to speculative execution with incorrect floating point results, may cause the use of incorrect data from FPVI and may result in data leakage.
Weaknesses (CWE)
References
- https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1003
- http://www.openwall.com/lists/oss-security/2021/06/09/2
- http://www.openwall.com/lists/oss-security/2021/06/10/1
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H36U6CNREC436W6GYO7QUMJIVEA35SCV/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SVA2NY26MMXOODUMYZN5DCU3FXMBMBOB/
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | LOW 2.1 | AV:L/AC:L/Au:N/C:P/I:N/A:N | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2021-13120
- GCVE · GCVE-0-2021-26314
Affected configurations (NVD CPE)
cpe:2.3:o:xen:xen:*:*:*:*:*:*:*:*cpe:2.3:h:arm:cortex-a72:-:*:*:*:*:*:*:*cpe:2.3:h:broadcom:bcm2711:-:*:*:*:*:*:*:*cpe:2.3:h:intel:core_i7-10700k:-:*:*:*:*:*:*:*cpe:2.3:h:intel:core_i7-7700k:-:*:*:*:*:*:*:*cpe:2.3:h:intel:core_i9-9900k:-:*:*:*:*:*:*:*cpe:2.3:h:intel:xeon_silver_4214:-:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| AMD · All supported processors | affected unspecified < undefined |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |