CVE-2021-26387 — Incorrect Authorization in AMD Epyc 7001 Series Processors

CWE-863 — Incorrect Authorization3 documents3 sources
Severity
3.9LOWNVD
EPSS
0.0%
top 94.00%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
8
AMD Epyc 7001 Series ProcessorsAMD Epyc 7002 Series ProcessorsAMD Epyc 7003 Series Processors+5 more
Timeline
PublishedAug 13

Description

Insufficient access controls in ASP kernel may allow a privileged attacker with access to AMD signing keys and the BIOS menu or UEFI shell to map DRAM regions in protected areas, potentially leading to a loss of platform integrity.

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:LExploitability: 0.8 | Impact: 2.7

Affected Packages8 packages

🔴Vulnerability Details

2
GHSA
GHSA-mcm9-3rfg-2mqm: Insufficient access controls in ASP kernel may allow a privileged attacker with access to AMD signing keys and the BIOS menu or UEFI shell to map DRAM↗2024-08-13
▶
CVEList
CVE-2021-26387: Insufficient access controls in ASP kernel may allow a privileged attacker with access to AMD signing keys and the BIOS menu or UEFI shell to map DRAM↗2024-08-13
▶
CVE-2021-26387 — Incorrect Authorization in AMD | cvebase