PT-2023-1487 · Amd · Amd Bios

Yngweijw · Published 2023-01-10 · Updated 2023-08-08 · CVE-2021-26316

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AMD BIOS software (affected versions not specified)

Description The issue is related to a failure in validating the communication buffer and service in the BIOS, which may allow an attacker to tamper with the buffer, potentially leading to arbitrary code execution in System Management Mode (SMM). The vulnerability is also described as being related to the copying of a buffer without checking the size of the input data, which could enable an attacker to execute arbitrary code.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Buffer Overflow

Weakness Enumeration

CWE-20

CWE-119

CWE-120

Related Identifiers

BDU:2023-00897

CVE-2021-26316

Affected Products

Amd Bios

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2021-26316 · Security Note
• https://amd.com/en/corporate/product-security/bulletin/AMD-SB-1032 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-00897 · Security Note
• https://osv.dev/vulnerability/CVE-2021-26316 · Vendor Advisory
• https://amd.com/en/corporate/product-security/bulletin/AMD-SB-1031 · Vendor Advisory
• https://t.me/pentestingnews/32197 · Telegram Post
• https://support.lenovo.com/us/en/product_security/LEN-87730 · Note
• https://amd.com/en/corporate/product-security/bulletin/amd-sb-1032 · Note