PT-2021-8201 · Amd+1 · Amd Epyc Agesa Pi+1

Hugo Magalhaes · Published 2021-11-09 · Updated 2024-12-09 · CVE-2020-12954

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions AMD EPYC AGESA PI (affected versions not specified)

Description The issue is related to a side effect of an integrated chipset option that can be exploited by an attacker to bypass SPI ROM protections, allowing unauthorized modification of the SPI ROM. This is due to errors in the integrated chipset. The exploitation of this issue can enable an attacker to circumvent the SPI ROM protection mechanism, potentially leading to data modification.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Protection Mechanism Failure

Race Condition

Weakness Enumeration

CWE-284

CWE-693

CWE-362

Related Identifiers

BDU:2024-11256

BDU:2024-11257

BDU:2024-11258

CVE-2020-12954

Affected Products

Amd Epyc Agesa Pi

Red Os

References · 12

• https://osv.dev/vulnerability/CVE-2020-12954 · Vendor Advisory
• https://amd.com/en/corporate/product-security/bulletin/amd-sb-1021 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-11257 · Security Note
• https://bdu.fstec.ru/vul/2024-11258 · Security Note
• https://bdu.fstec.ru/vul/2024-11256 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-12954 · Security Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-linux-firmware-cve-2020-12954-cve-2021-0146-cve-2021-26335-cve-2021-26334 · Note
• https://amd.com/en/corporate/product-security/bulletin/amd-sb-1027 · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-linux-firmware-cve-2020-12954-cve-2021-0146-cve-2021-26335-cve-2021-26334 · Note
• https://amd.com/en/resources/product-security/bulletin/amd-sb-1021.html · Note
• https://amd.com/en/resources/product-security/bulletin/amd-sb-1016.html · Note
• https://t.me/cibsecurity/32459 · Telegram Post