PT-2023-1487 · Amd · Amd Bios

Yngweijw · CVE-2021-26316 · Publicado 2023-01-10 · Atualizado 2023-08-08

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AMD BIOS software (affected versions not specified)

Description The issue is related to a failure in validating the communication buffer and service in the BIOS, which may allow an attacker to tamper with the buffer, potentially leading to arbitrary code execution in System Management Mode (SMM). The vulnerability is also described as being related to the copying of a buffer without checking the size of the input data, which could enable an attacker to execute arbitrary code.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Buffer Overflow

Enumeração de Fraquezas

CWE-20

CWE-119

CWE-120

Identificadores relacionados

BDU:2023-00897

CVE-2021-26316

Produtos afetados

Amd Bios

Referências · 8

• https://nvd.nist.gov/vuln/detail/CVE-2021-26316 · Nota de Segurança
• https://amd.com/en/corporate/product-security/bulletin/AMD-SB-1032 · Aviso do Fabricante
• https://t.me/pentestingnews/32197 · Publicação no Telegram
• https://bdu.fstec.ru/vul/2023-00897 · Nota de Segurança
• https://support.lenovo.com/us/en/product_security/LEN-87730 · Nota
• https://osv.dev/vulnerability/CVE-2021-26316 · Aviso do Fabricante
• https://amd.com/en/corporate/product-security/bulletin/amd-sb-1032 · Nota
• https://amd.com/en/corporate/product-security/bulletin/AMD-SB-1031 · Aviso do Fabricante