PT-2023-1408 · Amd · Amd Secure Processor

Published 2023-01-10 · Updated 2023-01-18 · CVE-2021-26396

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions AMD Secure Processor (affected versions not specified)

Description The issue is related to insufficient validation of address mapping to IO in the AMD Secure Processor, which may result in a loss of memory integrity in the SNP guest. This could potentially allow a remote attacker to impact the integrity of protected information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficient Verification of Data Authenticity

RCE

Weakness Enumeration

CWE-345

CWE-20

Related Identifiers

BDU:2023-00789

CVE-2021-26396

Affected Products

Amd Secure Processor

References · 6

• https://bdu.fstec.ru/vul/2023-00789 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-26396 · Security Note
• https://amd.com/en/corporate/product-security/bulletin/AMD-SB-1032 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-26396 · Vendor Advisory
• https://support.lenovo.com/us/en/product_security/LEN-87730 · Note
• https://amd.com/en/corporate/product-security/bulletin/amd-sb-1032 · Note