PT-2023-1406 · Amd · Amd Processors

Cfir Cohen + 2 · Published 2023-01-10 · Updated 2023-01-18 · CVE-2021-26328

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions AMD processors (affected versions not specified)

Description The issue is related to insufficient input validation in the implementation of the SNP INIT command for the AMD processor firmware loading mode. This could allow a remote attacker to compromise the integrity of protected information. Additionally, failure to verify the CPU execution mode during SNP INIT may lead to potential memory integrity loss for SNP guests.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improperly Implemented Security Check for Standard

RCE

Weakness Enumeration

CWE-358

CWE-20

Related Identifiers

BDU:2023-00786

CVE-2021-26328

Affected Products

Amd Processors

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2021-26328 · Security Note
• https://amd.com/en/corporate/product-security/bulletin/AMD-SB-1032 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-26328 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-00786 · Security Note
• https://support.lenovo.com/us/en/product_security/LEN-87730 · Note
• https://amd.com/en/corporate/product-security/bulletin/amd-sb-1032 · Note