PT-2022-6302 · Amd · System Management Mode

Published 2022-05-10 · Updated 2023-01-11 · CVE-2021-26353

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions System Management Mode (SMM) (affected versions not specified)

Description The issue is related to the failure to validate inputs in SMM, which may allow an attacker to create a mishandled error, leaving the DRTM UApp in a partially initialized state, potentially resulting in loss of memory integrity. This is due to insufficient input validation in the System Management Mode (SMM) implementation of AMD processor firmware. Exploitation of the issue may allow a remote attacker to impact the integrity of protected information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Improper Initialization

Weakness Enumeration

CWE-20

CWE-665

Related Identifiers

BDU:2023-00787

CVE-2021-26353

Affected Products

System Management Mode

References · 6

• https://bdu.fstec.ru/vul/2023-00787 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-26353 · Security Note
• https://osv.dev/vulnerability/CVE-2021-26353 · Vendor Advisory
• https://amd.com/en/corporate/product-security/bulletin/AMD-SB-1032 · Vendor Advisory
• https://support.lenovo.com/us/en/product_security/LEN-87730 · Note
• https://amd.com/en/corporate/product-security/bulletin/amd-sb-1032 · Note