CVE-2021-26356

published 2023-05-09

CVE-2021-26356: A TOCTOU in ASP bootloader may allow an attacker to tamper with the SPI ROM following data read to memory potentially resulting in S3 data corruption and…

Priority P3 39 high 7.4 CVSS 3.1

AV N AC H PR N UI N S U C H I H A N

A TOCTOU in ASP bootloader may allow an attacker
to tamper with the SPI ROM following data read to memory potentially resulting
in S3 data corruption and information disclosure.

Affected

80 ranges · showing 25

Vendor	Product	Version range	Fixed in
amd	1st_gen_amd_epyc_processors	—	—
amd	2nd_gen_amd_epyc_processors	—	—
amd	3rd_gen_amd_epyc_processors	—	—
amd	3rd_gen_amd_ryzen_threadripper_processors_castle_peak_hedt	—	—
amd	amd_ryzen_5000_series_desktop_processors_vermeer_am4	—	—
amd	epyc_7001_firmware	< naplespi_1.0.0.h	naplespi_1.0.0.h
amd	epyc_7002_firmware	< romepi_1.0.0.d	romepi_1.0.0.d
amd	epyc_7232p_firmware	< romepi_1.0.0.d	romepi_1.0.0.d
amd	epyc_7251_firmware	< naplespi_1.0.0.h	naplespi_1.0.0.h
amd	epyc_7252_firmware	< romepi_1.0.0.d	romepi_1.0.0.d
amd	epyc_7261_firmware	< naplespi_1.0.0.h	naplespi_1.0.0.h
amd	epyc_7262_firmware	< romepi_1.0.0.d	romepi_1.0.0.d
amd	epyc_7272_firmware	< romepi_1.0.0.d	romepi_1.0.0.d
amd	epyc_7281_firmware	< naplespi_1.0.0.h	naplespi_1.0.0.h
amd	epyc_7282_firmware	< romepi_1.0.0.d	romepi_1.0.0.d
amd	epyc_72f3_firmware	< milanpi_1.0.0.6	milanpi_1.0.0.6
amd	epyc_7301_firmware	< naplespi_1.0.0.h	naplespi_1.0.0.h
amd	epyc_7302_firmware	< romepi_1.0.0.d	romepi_1.0.0.d
amd	epyc_7302p_firmware	< romepi_1.0.0.d	romepi_1.0.0.d
amd	epyc_7313_firmware	< milanpi_1.0.0.6	milanpi_1.0.0.6
amd	epyc_7313p_firmware	< milanpi_1.0.0.6	milanpi_1.0.0.6
amd	epyc_7343_firmware	< milanpi_1.0.0.6	milanpi_1.0.0.6
amd	epyc_7351_firmware	< naplespi_1.0.0.h	naplespi_1.0.0.h
amd	epyc_7351p_firmware	< naplespi_1.0.0.h	naplespi_1.0.0.h
amd	epyc_7352_firmware	< romepi_1.0.0.d	romepi_1.0.0.d

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-367