PT-2018-1085 · Amd · Ryzen Mobile+3

Published 2018-03-12 · Updated 2020-08-24 · CVE-2018-8930

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions AMD EPYC Server, Ryzen, Ryzen Pro, and Ryzen Mobile processor chips (affected versions not specified)

Description The issue is related to the insufficient enforcement of Hardware Validated Boot in AMD processor chips. This allows an attacker with administrative privileges and access to the targeted computer to bypass code verification during the secure boot process. The attacker can then inject malicious code into the computer's BIOS by modifying the flash memory content.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-354

Related Identifiers

BDU:2018-00464

BDU:2018-00465

BDU:2018-00466

CVE-2018-8930

Affected Products

Amd Epyc Server

Ryzen

Ryzen Mobile

Ryzen Pro

References · 11

• https://community.amd.com/community/amd-corporate/blog/2018/03/21/initial-amd-technical-assessment-of-cts-labs-research · Vendor Advisory
• https://bdu.fstec.ru/vul/2018-00465 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-8930 · Security Note
• https://bdu.fstec.ru/vul/2018-00466 · Security Note
• https://bdu.fstec.ru/vul/2018-00464 · Security Note
• https://vuldb.com/de/?id.114933 · Note
• https://securitylab.ru/news/492088.php · Note
• https://blog.trailofbits.com/2018/03/15/amd-flaws-technical-summary · Note
• https://safefirmware.com/amdflaws_whitepaper.pdf · Note
• https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03841en_us · Note
• https://amdflaws.com · Note