CVE-2021-26315

published 2021-11-16

CVE-2021-26315: When the AMD Platform Security Processor (PSP) boot rom loads, authenticates, and subsequently decrypts an encrypted FW, due to insufficient verification of…

Priority P3 39 high 7.8 CVSS 3.1

AV L AC L PR L UI N S U C H I H A H

When the AMD Platform Security Processor (PSP) boot rom loads, authenticates, and subsequently decrypts an encrypted FW, due to insufficient verification of the integrity of decrypted image, arbitrary code may be executed in the PSP when encrypted firmware images are used.

Affected

21 ranges

Vendor	Product	Version range	Fixed in
amd	3rd_gen_amd_epyc	>= unspecified < MilanPI-SP3_1.0.0.4	MilanPI-SP3_1.0.0.4
amd	epyc_7003_firmware	< milanpi-sp3_1.0.0.4	milanpi-sp3_1.0.0.4
amd	epyc_72f3_firmware	< milanpi-sp3_1.0.0.4	milanpi-sp3_1.0.0.4
amd	epyc_7313_firmware	< milanpi-sp3_1.0.0.4	milanpi-sp3_1.0.0.4
amd	epyc_7313p_firmware	< milanpi-sp3_1.0.0.4	milanpi-sp3_1.0.0.4
amd	epyc_7343_firmware	< milanpi-sp3_1.0.0.4	milanpi-sp3_1.0.0.4
amd	epyc_73f3_firmware	< milanpi-sp3_1.0.0.4	milanpi-sp3_1.0.0.4
amd	epyc_7413_firmware	< milanpi-sp3_1.0.0.4	milanpi-sp3_1.0.0.4
amd	epyc_7443_firmware	< milanpi-sp3_1.0.0.4	milanpi-sp3_1.0.0.4
amd	epyc_7443p_firmware	< milanpi-sp3_1.0.0.4	milanpi-sp3_1.0.0.4
amd	epyc_7453_firmware	< milanpi-sp3_1.0.0.4	milanpi-sp3_1.0.0.4
amd	epyc_74f3_firmware	< milanpi-sp3_1.0.0.4	milanpi-sp3_1.0.0.4
amd	epyc_7513_firmware	< milanpi-sp3_1.0.0.4	milanpi-sp3_1.0.0.4
amd	epyc_7543_firmware	< milanpi-sp3_1.0.0.4	milanpi-sp3_1.0.0.4
amd	epyc_7543p_firmware	< milanpi-sp3_1.0.0.4	milanpi-sp3_1.0.0.4
amd	epyc_75f3_firmware	< milanpi-sp3_1.0.0.4	milanpi-sp3_1.0.0.4
amd	epyc_7643_firmware	< milanpi-sp3_1.0.0.4	milanpi-sp3_1.0.0.4
amd	epyc_7663_firmware	< milanpi-sp3_1.0.0.4	milanpi-sp3_1.0.0.4
amd	epyc_7713_firmware	< milanpi-sp3_1.0.0.4	milanpi-sp3_1.0.0.4
amd	epyc_7713p_firmware	< milanpi-sp3_1.0.0.4	milanpi-sp3_1.0.0.4
amd	epyc_7763_firmware	< milanpi-sp3_1.0.0.4	milanpi-sp3_1.0.0.4

CVSS provenance

nvd v3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 4.6 MEDIUM AV:L/AC:L/Au:N/C:P/I:P/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-345