PT-2022-9757 · Amd · Amd Secure Processor

Mahdi Braik · CVE-2021-26393 · Published 2022-11-09 · Updated 2024-09-16

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions AMD Secure Processor (ASP) (affected versions not specified)

Description The issue is related to insufficient memory cleanup in the AMD Secure Processor (ASP) Trusted Execution Environment (TEE). This may allow an authenticated attacker with privileges to generate a valid signed TA and potentially poison the contents of the process memory with attacker-controlled data, resulting in a loss of confidentiality.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

CVE-2021-26393

Affected Products

Amd Secure Processor

References · 6

• https://osv.dev/vulnerability/CVE-2021-26393 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-26393 · Security Note
• https://amd.com/en/corporate/product-security/bulletin/amd-sb-1029 · Vendor Advisory
• https://amd.com/en/corporate/product-security/bulletin/amd-sb-5001 · Note
• https://t.me/cibsecurity/52728 · Telegram Post
• https://t.me/cvenotify/71312 · Telegram Post