AMD 3rd Gen EPYC
26 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2023-20532 | various | Insufficient input validation in the SMU may allow an attacker to improperly lock resources, potentially resulting in a denial of service. | MEDIUM 5.3 | 0.6 % | ||
| CVE-2023-20531 | various | Insufficient bound checks in the SMU may allow an attacker to update the SRAM from/to address space to an invalid value potentially resultin | HIGH 7.5 | 0.6 % | ||
| CVE-2023-20530 | various | Insufficient input validation of BIOS mailbox messages in SMU may result in out-of-bounds memory reads potentially resulting in a denial of | HIGH 7.5 | 0.6 % | ||
| CVE-2023-20529 | various | Insufficient bound checks in the SMU may allow an attacker to update the from/to address space to an invalid value potentially resulting in | HIGH 7.5 | 0.6 % | ||
| CVE-2023-20528 | various | Insufficient input validation in the SMU may allow a physical attacker to exfiltrate SMU memory contents over the I2C bus potentially leadin | LOW 2.4 | 0.3 % | ||
| CVE-2023-20527 | various | Improper syscall input validation in the ASP Bootloader may allow a privileged attacker to read memory out-of-bounds, potentially leading to | MEDIUM 6.5 | 0.6 % | ||
| CVE-2023-20525 | various | Insufficient syscall input validation in the ASP Bootloader may allow a privileged attacker to read memory outside the bounds of a mapped re | MEDIUM 6.5 | 0.6 % | ||
| CVE-2023-20523 | various | TOCTOU in the ASP may allow a physical attacker to write beyond the buffer bounds, potentially leading to a loss of integrity or denial of s | MEDIUM 5.7 | 0.2 % | ||
| CVE-2023-20522 | various | Insufficient input validation in ASP may allow an attacker with a malicious BIOS to potentially cause a denial of service. | HIGH 7.5 | 0.6 % | ||
| CVE-2022-23814 | various | Failure to validate addresses provided by software to BIOS commands may result in a potential loss of integrity of guest memory in a confide | MEDIUM 5.3 | 0.5 % | ||
| CVE-2022-23813 | various | The software interfaces to ASP and SMU may not enforce the SNP memory security policy resulting in a potential loss of integrity of guest me | MEDIUM 5.3 | 0.5 % | ||
| CVE-2021-46791 | various | Insufficient input validation during parsing of the System Management Mode (SMM) binary may allow a maliciously crafted SMM executable binar | MEDIUM 5.5 | 0.2 % | ||
| CVE-2021-46779 | various | Insufficient input validation in SVC_ECC_PRIMITIVE system call in a compromised user application or ABL may allow an attacker to corrupt ASP | HIGH 7.1 | 0.2 % | ||
| CVE-2021-46768 | various | Insufficient input validation in SEV firmware may allow an attacker to perform out-of-bounds memory reads within the ASP boot loader, potent | MEDIUM 5.5 | 0.2 % | ||
| CVE-2021-46767 | various | Insufficient input validation in the ASP may allow an attacker with physical access, unauthorized write access to memory potentially leading | MEDIUM 6.1 | 0.3 % | ||
| CVE-2021-26409 | various | Insufficient bounds checking in SEV-ES may allow an attacker to corrupt Reverse Map table (RMP) memory, potentially resulting in a loss of S | HIGH 7.8 | 0.2 % | ||
| CVE-2021-26404 | various | Improper input validation and bounds checking in SEV firmware may leak scratch buffer bytes leading to potential information disclosure. | MEDIUM 5.5 | 0.2 % | ||
| CVE-2021-26402 | various | Insufficient bounds checking in ASP (AMD Secure Processor) firmware while handling BIOS mailbox commands, may allow an attacker to write par | HIGH 7.1 | 0.2 % | ||
| CVE-2021-26398 | various | Insufficient input validation in SYS_KEY_DERIVE system call in a compromised user application or ABL may allow an attacker to corrupt ASP (A | HIGH 7.8 | 0.2 % | ||
| CVE-2021-26396 | various | Insufficient validation of address mapping to IO in ASP (AMD Secure Processor) may result in a loss of memory integrity in the SNP guest. | MEDIUM 4.4 | 0.1 % | ||
| CVE-2021-26355 | various | Insufficient fencing and checks in System Management Unit (SMU) may result in access to invalid message port registers that could result in | MEDIUM 5.5 | 0.2 % | ||
| CVE-2021-26343 | various | Insufficient validation in ASP BIOS and DRTM commands may allow malicious supervisor x86 software to disclose the contents of sensitive memo | MEDIUM 5.5 | 0.2 % | ||
| CVE-2021-26328 | various | Failure to verify the mode of CPU execution at the time of SNP_INIT may lead to a potential loss of memory integrity for SNP guests. | MEDIUM 4.4 | 0.2 % | ||
| CVE-2021-26316 | | Failure to validate the communication buffer and communication service in the BIOS may allow an attacker to tamper with the buffer resulting | HIGH 7.8 | 0.3 % | ||
| CVE-2021-26353 | various | Failure to validate inputs in SMM may allow an attacker to create a mishandled error leaving the DRTM UApp in a partially initialized state | HIGH 7.8 | 0.3 % | ||
| CVE-2021-39298 | various | A potential vulnerability in AMD System Management Mode (SMM) interrupt handler may allow an attacker with high privileges to access the SMM | HIGH 8.8 | 0.4 % |