PT-2023-1406 · Amd · Amd Processors

Cfir Cohen + 2 · Publicado 2023-01-10 · Atualizado 2023-01-18 · CVE-2021-26328

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions AMD processors (affected versions not specified)

Description The issue is related to insufficient input validation in the implementation of the SNP INIT command for the AMD processor firmware loading mode. This could allow a remote attacker to compromise the integrity of protected information. Additionally, failure to verify the CPU execution mode during SNP INIT may lead to potential memory integrity loss for SNP guests.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improperly Implemented Security Check for Standard

RCE

Enumeração de Fraquezas

CWE-358

CWE-20

Identificadores relacionados

BDU:2023-00786

CVE-2021-26328

Produtos afetados

Amd Processors

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2021-26328 · Nota de Segurança
• https://amd.com/en/corporate/product-security/bulletin/AMD-SB-1032 · Aviso do Fabricante
• https://support.lenovo.com/us/en/product_security/LEN-87730 · Nota
• https://amd.com/en/corporate/product-security/bulletin/amd-sb-1032 · Nota
• https://osv.dev/vulnerability/CVE-2021-26328 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-00786 · Nota de Segurança