CVE-2021-26316 — Improper Input Validation in AMD Epyc 7002 Firmware

CWE-20 — Improper Input ValidationCWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer4 documents4 sources
Severity
7.8HIGHNVD
EPSS
0.1%
top 82.79%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
56
AMD Epyc 7002 FirmwareAMD Epyc 7003 FirmwareAMD Epyc 7232p Firmware+53 more
Timeline
PublishedJan 11

Description

Failure to validate the communication buffer and communication service in the BIOS may allow an attacker to tamper with the buffer resulting in potential SMM (System Management Mode) arbitrary code execution.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages56 packages

▶NVDamd/epyc_7002_firmware< romepi_1.0.0.d
▶NVDamd/epyc_7003_firmware< milanpi-sp3_1.0.0.8
▶NVDamd/epyc_7252_firmware< romepi_1.0.0.d
▶NVDamd/epyc_7262_firmware< romepi_1.0.0.d
▶NVDamd/epyc_7272_firmware< romepi_1.0.0.d

🔴Vulnerability Details

2
GHSA
GHSA-hr2h-gpm8-8hqc: Failure to validate the communication buffer and communication service in the BIOS may allow an attacker to tamper with the buffer resulting in potent↗2023-01-11
▶
CVEList
CVE-2021-26316: Failure to validate the communication buffer and communication service in the BIOS may allow an attacker to tamper with the buffer resulting in potent↗2023-01-10
▶

📋Vendor Advisories

1
Red Hat
hw: amd: arbitrary code execution in bios due to a fault in communication buffer↗2023-01-10
▶
CVE-2021-26316 — Improper Input Validation in AMD | cvebase