PT-2021-17003 · Amd · Sev Firmware

Cfir Cohen + 2 · Published 2021-11-16 · Updated 2021-11-19 · CVE-2021-26321

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions SEV Firmware (affected versions not specified)

Description The issue is related to insufficient ID command validation in the SEV Firmware, which may allow a local authenticated attacker to perform a denial of service of the PSP.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Command Injection

RCE

Weakness Enumeration

CWE-77

CWE-20

Related Identifiers

CVE-2021-26321

Affected Products

Sev Firmware

References · 4

• https://osv.dev/vulnerability/CVE-2021-26321 · Vendor Advisory
• https://amd.com/en/corporate/product-security/bulletin/amd-sb-1021 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-26321 · Security Note
• https://t.me/cibsecurity/32447 · Telegram Post