CVE-2021-26353 — Improper Initialization in AMD Epyc 72f3 Firmware

CWE-665 — Improper InitializationCWE-772 — Missing Release of Resource after Effective Lifetime5 documents5 sources
Severity
7.8HIGHNVD
EPSS
0.1%
top 66.68%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
24
AMD Epyc 72f3 FirmwareAMD Epyc 7313 FirmwareAMD Epyc 7313p Firmware+21 more
Timeline
PublishedMay 10
Latest updateMay 11

Description

Failure to validate inputs in SMM may allow an attacker to create a mishandled error leaving the DRTM UApp in a partially initialized state potentially resulting in loss of memory integrity.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages24 packages

▶NVDamd/epyc_72f3_firmware< milanpi-sp3_1.0.0.4
▶NVDamd/epyc_7313_firmware< milanpi-sp3_1.0.0.4
▶NVDamd/epyc_7343_firmware< milanpi-sp3_1.0.0.4
▶NVDamd/epyc_73f3_firmware< milanpi-sp3_1.0.0.4
▶NVDamd/epyc_7413_firmware< milanpi-sp3_1.0.0.4

🔴Vulnerability Details

2
GHSA
GHSA-3972-3jg9-99pp: Due to a mishandled error, it is possible to leave the DRTM UApp in a partially initialized state, which can result in unchecked memory writes when th↗2022-05-11
▶
CVEList
CVE-2021-26353: Failure to validate inputs in SMM may allow an attacker to create a mishandled error leaving the DRTM UApp in a partially initialized state potentiall↗2022-05-10
▶

📋Vendor Advisories

2
Microsoft
A flaw was found in the virtio-net device of QEMU. This flaw was inadvertently introduced with the fix for CVE-2021-3748 which forgot to unmap the cached virtqueue elements on error leading to memory ↗2022-03-08
▶
Red Hat
QEMU: virtio-net: map leaking on error during receive↗2022-03-08
▶
CVE-2021-26353 — Improper Initialization in AMD | cvebase