CVE-2021-26397 — AMD Epyc 72f3 Firmware vulnerability

3 documents3 sources
Severity
7.1HIGHNVD
EPSS
0.0%
top 88.60%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
24
AMD Epyc 72f3 FirmwareAMD Epyc 7313 FirmwareAMD Epyc 7313p Firmware+21 more
Timeline
PublishedMay 9

Description

Insufficient address validation, may allow an attacker with a compromised ABL and UApp to corrupt sensitive memory locations potentially resulting in a loss of integrity or availability.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:HExploitability: 1.8 | Impact: 5.2

Affected Packages24 packages

▶NVDamd/epyc_72f3_firmware< milanpi_1.0.0.9
▶NVDamd/epyc_7313_firmware< milanpi_1.0.0.9
▶NVDamd/epyc_7343_firmware< milanpi_1.0.0.9
▶NVDamd/epyc_73f3_firmware< milanpi_1.0.0.9
▶NVDamd/epyc_7413_firmware< milanpi_1.0.0.9

🔴Vulnerability Details

2
CVEList
CVE-2021-26397: Insufficient address validation, may allow an attacker with a compromised ABL and UApp to corrupt sensitive memory locations potentially resulting in↗2023-05-09
▶
GHSA
GHSA-9xw2-mpxf-37x2: Insufficient address validation, may allow an attacker with a compromised ABL and UApp to corrupt sensitive memory locations potentially resulting in↗2023-05-09
▶
CVE-2021-26397 — AMD Epyc 72f3 Firmware vulnerability | cvebase