PT-2022-10894 · Amd · System Management Mode

Hugo Magalhaes · Published 2022-02-16 · Updated 2023-01-11 · CVE-2021-39298

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AMD System Management Mode (SMM) (affected versions not specified) UEFI firmware (BIOS) for some PC products (affected versions not specified)

Description A potential issue in AMD System Management Mode (SMM) interrupt handler may allow an attacker with high privileges to access the SMM, resulting in arbitrary code execution. This could be used by malicious actors to bypass security mechanisms provided in the UEFI firmware. The issue may allow escalation of privilege and arbitrary code execution in UEFI firmware (BIOS) for some PC products.

Recommendations For AMD System Management Mode (SMM), at the moment, there is no information about a newer version that contains a fix for this vulnerability. For UEFI firmware (BIOS) for some PC products, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2021-39298

Affected Products

System Management Mode

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2021-39298 · Security Note
• https://amd.com/en/corporate/product-security/bulletin/AMD-SB-1032 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-39298 · Vendor Advisory
• https://amd.com/en/corporate/product-security/bulletin/AMD-SB-1027 · Note
• https://t.me/cibsecurity/37586 · Telegram Post
• https://t.me/cvenotify/27850 · Telegram Post