AMD 1st Gen EPYC

CVE-2021-26398

HIGH 7.8

En bref

Source: NVD
EPSS: EPSS 0.22 % · centile 13 (2026-10-31)
État: PUBLISHED
Publiée: 2023-01-10 20:56 UTC
Mise à jour: 2025-04-09 14:38 UTC
Attribuée par: AMD
Statut NVD: Modified

Rechercher sur…

Description

Insufficient input validation in SYS_KEY_DERIVE system call in a compromised user application or ABL may allow an attacker to corrupt ASP (AMD Secure Processor) OS memory which may lead to potential arbitrary code execution.

Faiblesses (CWE)

CWE-787 — Écriture hors limites

Références

https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.1	HIGH 7.8	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	CISA-ADP
CVSS 3.1	HIGH 7.8	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	NVD · nvd@nist.gov (Primary)
CVSS 3.1	HIGH 7.8	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Références européennes

ENISA EUVD · EUVD-2021-13204
GCVE · GCVE-0-2021-26398

Configurations affectées (CPE NVD)

cpe:2.3:o:amd:epyc_7h12_firmware:*:*:*:*:*:*:*:* < romepi_1.0.0.c
cpe:2.3:o:amd:epyc_7f72_firmware:*:*:*:*:*:*:*:* < romepi_1.0.0.c
cpe:2.3:o:amd:epyc_7f52_firmware:*:*:*:*:*:*:*:* < romepi_1.0.0.c
cpe:2.3:o:amd:epyc_7f32_firmware:*:*:*:*:*:*:*:* < romepi_1.0.0.c
cpe:2.3:o:amd:epyc_7742_firmware:*:*:*:*:*:*:*:* < romepi_1.0.0.c
cpe:2.3:o:amd:epyc_7702p_firmware:*:*:*:*:*:*:*:* < romepi_1.0.0.c
cpe:2.3:o:amd:epyc_7702_firmware:*:*:*:*:*:*:*:* < romepi_1.0.0.c
cpe:2.3:o:amd:epyc_7662_firmware:*:*:*:*:*:*:*:* < romepi_1.0.0.c
cpe:2.3:o:amd:epyc_7642_firmware:*:*:*:*:*:*:*:* < romepi_1.0.0.c
cpe:2.3:o:amd:epyc_7552_firmware:*:*:*:*:*:*:*:* < romepi_1.0.0.c
cpe:2.3:o:amd:epyc_7542_firmware:*:*:*:*:*:*:*:* < romepi_1.0.0.c
cpe:2.3:o:amd:epyc_7532_firmware:*:*:*:*:*:*:*:* < romepi_1.0.0.c
cpe:2.3:o:amd:epyc_7502p_firmware:*:*:*:*:*:*:*:* < romepi_1.0.0.c
cpe:2.3:o:amd:epyc_7502_firmware:*:*:*:*:*:*:*:* < romepi_1.0.0.c
cpe:2.3:o:amd:epyc_7452_firmware:*:*:*:*:*:*:*:* < romepi_1.0.0.c
cpe:2.3:o:amd:epyc_7402_firmware:*:*:*:*:*:*:*:* < romepi_1.0.0.c
cpe:2.3:o:amd:epyc_7402p_firmware:*:*:*:*:*:*:*:* < romepi_1.0.0.c
cpe:2.3:o:amd:epyc_7352_firmware:*:*:*:*:*:*:*:* < romepi_1.0.0.c
cpe:2.3:o:amd:epyc_7302p_firmware:*:*:*:*:*:*:*:* < romepi_1.0.0.c
cpe:2.3:o:amd:epyc_7302_firmware:*:*:*:*:*:*:*:* < romepi_1.0.0.c
cpe:2.3:o:amd:epyc_7282_firmware:*:*:*:*:*:*:*:* < romepi_1.0.0.c
cpe:2.3:o:amd:epyc_7272_firmware:*:*:*:*:*:*:*:* < romepi_1.0.0.c
cpe:2.3:o:amd:epyc_7262_firmware:*:*:*:*:*:*:*:* < romepi_1.0.0.c
cpe:2.3:o:amd:epyc_7252_firmware:*:*:*:*:*:*:*:* < romepi_1.0.0.c
cpe:2.3:o:amd:epyc_7232p_firmware:*:*:*:*:*:*:*:* < romepi_1.0.0.c
cpe:2.3:o:amd:epyc_7002_firmware:*:*:*:*:*:*:*:* < romepi_1.0.0.c
cpe:2.3:o:amd:epyc_7003_firmware:*:*:*:*:*:*:*:* < milanpi_1.0.0.4
cpe:2.3:o:amd:epyc_72f3_firmware:*:*:*:*:*:*:*:* < milanpi_1.0.0.4
cpe:2.3:o:amd:epyc_7313_firmware:*:*:*:*:*:*:*:* < milanpi_1.0.0.4
cpe:2.3:o:amd:epyc_7313p_firmware:*:*:*:*:*:*:*:* < milanpi_1.0.0.4
cpe:2.3:o:amd:epyc_7343_firmware:*:*:*:*:*:*:*:* < milanpi_1.0.0.4
cpe:2.3:o:amd:epyc_7373x_firmware:*:*:*:*:*:*:*:* < milanpi_1.0.0.4
cpe:2.3:o:amd:epyc_73f3_firmware:*:*:*:*:*:*:*:* < milanpi_1.0.0.4
cpe:2.3:o:amd:epyc_7413_firmware:*:*:*:*:*:*:*:* < milanpi_1.0.0.4
cpe:2.3:o:amd:epyc_7443_firmware:*:*:*:*:*:*:*:* < milanpi_1.0.0.4
cpe:2.3:o:amd:epyc_7443p_firmware:*:*:*:*:*:*:*:* < milanpi_1.0.0.4
cpe:2.3:o:amd:epyc_7453_firmware:*:*:*:*:*:*:*:* < milanpi_1.0.0.4
cpe:2.3:o:amd:epyc_74f3_firmware:*:*:*:*:*:*:*:* < milanpi_1.0.0.4
cpe:2.3:o:amd:epyc_7513_firmware:*:*:*:*:*:*:*:* < milanpi_1.0.0.4
cpe:2.3:o:amd:epyc_7543_firmware:*:*:*:*:*:*:*:* < milanpi_1.0.0.4
+24 autres

Produits affectés

Produit	Versions
AMD · 1st Gen EPYC	affected various
AMD · 2nd Gen EPYC	affected Various
AMD · 3rd Gen EPYC	affected various

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD

⚠️ AMD 1st Gen EPYC