PT-2020-13321 · Amd · Amd Processors

Danny Odler · Published 2020-06-21 · Updated 2021-12-15 · CVE-2020-12890

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions AMD processors (affected versions not specified)

Description The issue is related to improper handling of pointers in the System Management Mode (SMM) handling code, which may allow a privileged attacker with physical or administrative access to manipulate the AMD Generic Encapsulated Software Architecture (AGESA) and execute arbitrary code undetected by the operating system. This could potentially lead to control over the UEFI firmware, resulting in full access to the system. The attack requires either physical access to the equipment or administrative access to the system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2020-12890

Affected Products

Amd Processors

References · 7

• https://amd.com/en/corporate/product-security · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-12890 · Security Note
• https://t.me/opennews/7016 · Telegram Post
• https://t.me/tmfeed/87376 · Telegram Post
• https://t.me/cybersecuritytechnologies/1301 · Telegram Post
• https://t.me/opennews/7014 · Telegram Post
• https://t.me/opennews/7015 · Telegram Post