CVE-2021-26343: Insufficient validation in ASP BIOS and DRTM commands may allow malicious supervisor x86 software to disclose the contents of sensitive memory which may result…

PriorityP423medium5.5CVSS 3.1

AVLACLPRLUINSUCHINAN

EPSS

0.18%

8.2th percentile

Insufficient validation in ASP BIOS and DRTM commands may allow malicious supervisor x86 software to disclose the contents of sensitive memory which may result in information disclosure.

Affected

25 ranges

Vendor	Product	Version range	Fixed in
amd	3rd_gen_epyc	—	—
amd	epyc_7003_firmware	< milanpi_1.0.0.3	milanpi_1.0.0.3
amd	epyc_72f3_firmware	< milanpi_1.0.0.3	milanpi_1.0.0.3
amd	epyc_7313_firmware	< milanpi_1.0.0.3	milanpi_1.0.0.3
amd	epyc_7313p_firmware	< milanpi_1.0.0.3	milanpi_1.0.0.3
amd	epyc_7343_firmware	< milanpi_1.0.0.3	milanpi_1.0.0.3
amd	epyc_7373x_firmware	< milanpi_1.0.0.3	milanpi_1.0.0.3
amd	epyc_73f3_firmware	< milanpi_1.0.0.3	milanpi_1.0.0.3
amd	epyc_7413_firmware	< milanpi_1.0.0.3	milanpi_1.0.0.3
amd	epyc_7443_firmware	< milanpi_1.0.0.3	milanpi_1.0.0.3
amd	epyc_7443p_firmware	< milanpi_1.0.0.3	milanpi_1.0.0.3
amd	epyc_7453_firmware	< milanpi_1.0.0.3	milanpi_1.0.0.3
amd	epyc_74f3_firmware	< milanpi_1.0.0.3	milanpi_1.0.0.3
amd	epyc_7513_firmware	< milanpi_1.0.0.3	milanpi_1.0.0.3
amd	epyc_7543_firmware	< milanpi_1.0.0.3	milanpi_1.0.0.3
amd	epyc_7543p_firmware	< milanpi_1.0.0.3	milanpi_1.0.0.3
amd	epyc_7573x_firmware	< milanpi_1.0.0.3	milanpi_1.0.0.3
amd	epyc_75f3_firmware	< milanpi_1.0.0.3	milanpi_1.0.0.3
amd	epyc_7643_firmware	< milanpi_1.0.0.3	milanpi_1.0.0.3
amd	epyc_7663_firmware	< milanpi_1.0.0.3	milanpi_1.0.0.3
amd	epyc_7713_firmware	< milanpi_1.0.0.3	milanpi_1.0.0.3
amd	epyc_7713p_firmware	< milanpi_1.0.0.3	milanpi_1.0.0.3
amd	epyc_7743_firmware	< milanpi_1.0.0.3	milanpi_1.0.0.3
amd	epyc_7763_firmware	< milanpi_1.0.0.3	milanpi_1.0.0.3
amd	epyc_7773x_firmware	< milanpi_1.0.0.3	milanpi_1.0.0.3

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.