AMD 2nd Gen EPYC
At a glance
- Source
- NVD
- EPSS
- EPSS 0.37 % · percentile 31 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- AMD
- NVD status
- Modified
Description
A potential vulnerability in AMD System Management Mode (SMM) interrupt handler may allow an attacker with high privileges to access the SMM resulting in arbitrary code execution which could be used by malicious actors to bypass security mechanisms provided in the UEFI firmware.
Weaknesses (CWE)
- CWE-269 — Improper Privilege Management
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H | CISA-ADP |
| CVSS 3.1 | HIGH 8.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
| CVSS 2.0 | HIGH 7.2 | AV:L/AC:L/Au:N/C:C/I:C/A:C | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2021-25659
- GCVE · GCVE-0-2021-39298
Affected configurations (NVD CPE)
cpe:2.3:o:hp:z1_entry_tower_g5_workstation_firmware:*:*:*:*:*:*:*:*< 02.12.00cpe:2.3:o:hp:z1_entry_tower_g6_workstation_firmware:*:*:*:*:*:*:*:*< 02.10.00cpe:2.3:o:hp:z1_g8_tower_desktop_pc_firmware:*:*:*:*:*:*:*:*< 02.07.00cpe:2.3:o:hp:z4_g4_workstation_\(core-x\)_firmware:*:*:*:*:*:linux_kernel:*:*< 02.75cpe:2.3:o:hp:z4_g4_workstation_\(core-x\)_firmware:*:*:*:*:*:windows_10:*:*< 02.75cpe:2.3:o:hp:z4_g4_workstation_\(core-x\)_firmware:*:*:*:*:*:windows_7:*:*< 02.75cpe:2.3:o:hp:z4_g4_workstation_\(xeon_w\)_firmware:*:*:*:*:*:linux_kernel:*:*< 02.75cpe:2.3:o:hp:z4_g4_workstation_\(xeon_w\)_firmware:*:*:*:*:*:windows_10:*:*< 02.75cpe:2.3:o:hp:z4_g4_workstation_\(xeon_w\)_firmware:*:*:*:*:*:windows_7:*:*< 02.75cpe:2.3:o:hp:z6_g4_workstation_firmware:*:*:*:*:*:linux_kernel:*:*< 02.75cpe:2.3:o:hp:z6_g4_workstation_firmware:*:*:*:*:*:windows_10:*:*< 02.75cpe:2.3:o:hp:z6_g4_workstation_firmware:*:*:*:*:*:windows_7:*:*< 02.75cpe:2.3:o:hp:z8_g4_workstation_firmware:*:*:*:*:*:linux_kernel:*:*< 02.75cpe:2.3:o:hp:z8_g4_workstation_firmware:*:*:*:*:*:windows_10:*:*< 02.75cpe:2.3:o:hp:z8_g4_workstation_firmware:*:*:*:*:*:windows_7:*:*< 02.75cpe:2.3:o:hp:engage_flex_mini_retail_system_firmware:*:*:*:*:*:*:*:*< 02.10.00cpe:2.3:o:hp:mp9_g4_retail_system_firmware:*:*:*:*:*:*:*:*< 02.18.00cpe:2.3:o:hp:elite_dragonfly_firmware:*:*:*:*:*:*:*:*< 01.12.00cpe:2.3:o:hp:elite_dragonfly_g2_firmware:*:*:*:*:*:*:*:*< 01.08.00cpe:2.3:o:hp:elite_dragonfly_max_firmware:*:*:*:*:*:*:*:*< 01.08.00cpe:2.3:o:hp:elite_x2_1013_g3_firmware:*:*:*:*:*:*:*:*< 01.19.00cpe:2.3:o:hp:elite_x2_g4_firmware:*:*:*:*:*:*:*:*< 01.12.00cpe:2.3:o:hp:elite_x2_g8_tablet_firmware:*:*:*:*:*:*:*:*< 01.08.00cpe:2.3:o:hp:elitebook_1050_g1_firmware:*:*:*:*:*:*:*:*< 01.19.00cpe:2.3:o:hp:elitebook_830_g5_firmware:*:*:*:*:*:*:*:*< 01.19.00cpe:2.3:o:hp:elitebook_830_g6_firmware:*:*:*:*:*:*:*:*< 01.12.00cpe:2.3:o:hp:elitebook_830_g7_firmware:*:*:*:*:*:*:*:*< 01.08.00cpe:2.3:o:hp:elitebook_830_g8_firmware:*:*:*:*:*:*:*:*< 01.08.00cpe:2.3:o:hp:elitebook_836_g5_firmware:*:*:*:*:*:*:*:*< 01.19.00cpe:2.3:o:hp:elitebook_836_g6_firmware:*:*:*:*:*:*:*:*< 01.12.00cpe:2.3:o:hp:elitebook_840_aero_g8_firmware:*:*:*:*:*:*:*:*< 01.08.00cpe:2.3:o:hp:elitebook_840_g5_firmware:*:*:*:*:*:*:*:*< 01.19.00cpe:2.3:o:hp:elitebook_840_g5_healthcare_edition_firmware:*:*:*:*:*:*:*:*< 01.19.00cpe:2.3:o:hp:elitebook_840_g6_firmware:*:*:*:*:*:*:*:*< 01.12.00cpe:2.3:o:hp:elitebook_840_g6_healthcare_edition_firmware:*:*:*:*:*:*:*:*< 01.12.00cpe:2.3:o:hp:elitebook_840_g7_firmware:*:*:*:*:*:*:*:*< 01.08.00cpe:2.3:o:hp:elitebook_840_g8_firmware:*:*:*:*:*:*:*:*< 01.08.00cpe:2.3:o:hp:elitebook_840r_g4_firmware:*:*:*:*:*:*:*:*< 01.19.00cpe:2.3:o:hp:elitebook_846_g5_firmware:*:*:*:*:*:*:*:*< 01.19.00cpe:2.3:o:hp:elitebook_850_g5_firmware:*:*:*:*:*:*:*:*< 01.19.00- +156 more
Affected products
| Product | Versions |
|---|---|
| AMD · 2nd Gen EPYC | affected Various |
| AMD · 3rd Gen EPYC | affected various |
| AMD · Ryzen 2000 Series | affected various |
| AMD · Ryzen 3000 Series | affected Various |
| AMD · Ryzen 5000 Series | affected various |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |