Amd 3Rd Gen Amd Epyc Processors vulnerabilities

CVE-2022-23820 [CRITICAL] CWE-20 CVE-2022-23820: Failure to validate the AMD SMM communication buffer may allow an attacker to corrupt the SMRAM pote Failure to validate the AMD SMM communication buffer may allow an attacker to corrupt the SMRAM potentially leading to arbitrary code execution.

CVE-2021-46756 [CRITICAL] CWE-20 CVE-2021-46756: Insufficient validation of inputs in SVC_MAP_USER_STACK in the ASP (AMD Secure Processor) bootloader Insufficient validation of inputs in SVC_MAP_USER_STACK in the ASP (AMD Secure Processor) bootloader may allow an attacker with a malicious Uapp or ABL to send malformed or invalid syscall to the bootloader resulting in a potential denial of service and loss of integrity.

CVE-2023-20566 [HIGH] CVE-2023-20566: Improper address validation in ASP with SNP enabled may potentially allow an attacker to compromise Improper address validation in ASP with SNP enabled may potentially allow an attacker to compromise guest memory integrity.

CVE-2022-23829 [HIGH] CWE-284 CVE-2022-23829: A potential weakness in AMD SPI protection features may allow a malicious attacker with Ring0 (kerne A potential weakness in AMD SPI protection features may allow a malicious attacker with Ring0 (kernel mode) access to bypass the native System Management Mode (SMM) ROM protections.

CVE-2021-26356 [HIGH] CWE-367 CVE-2021-26356: A TOCTOU in ASP bootloader may allow an attacker to tamper with the SPI ROM following data read to m A TOCTOU in ASP bootloader may allow an attacker to tamper with the SPI ROM following data read to memory potentially resulting in S3 data corruption and information disclosure.

CVE-2024-21980 [HIGH] CWE-119 CVE-2024-21980: Improper restriction of write operations in SNP firmware could allow a malicious hypervisor to poten Improper restriction of write operations in SNP firmware could allow a malicious hypervisor to potentially overwrite a guest's memory or UMC seed resulting in loss of confidentiality and integrity.

CVE-2023-31315 [HIGH] CWE-94 CVE-2023-31315: Improper validation in a model specific register (MSR) could allow a malicious program with ring0 ac Improper validation in a model specific register (MSR) could allow a malicious program with ring0 access to modify SMM configuration while SMI lock is enabled, potentially leading to arbitrary code execution.

CVE-2021-46774 [HIGH] CVE-2021-46774: Insufficient DRAM address validation in System Management Unit (SMU) may allow an attacker to read/w Insufficient DRAM address validation in System Management Unit (SMU) may allow an attacker to read/write from/to an invalid DRAM address, potentially resulting in denial-of-service.

CVE-2023-20533 [HIGH] CVE-2023-20533: Insufficient DRAM address validation in System Management Unit (SMU) may allow an attacker to read/w Insufficient DRAM address validation in System Management Unit (SMU) may allow an attacker to read/write from/to an invalid DRAM address, potentially resulting in denial-of-service.

CVE-2024-21978 [HIGH] CWE-20 CVE-2024-21978: Improper input validation in SEV-SNP could allow a malicious hypervisor to read or overwrite guest m Improper input validation in SEV-SNP could allow a malicious hypervisor to read or overwrite guest memory potentially leading to data leakage or data corruption.

CVE-2023-20587 [HIGH] CWE-284 CVE-2023-20587: Improper Access Control in System Management Mode (SMM) may allow an attacker access to the SPI flas Improper Access Control in System Management Mode (SMM) may allow an attacker access to the SPI flash potentially leading to arbitrary code execution.

CVE-2023-20592 [MEDIUM] CVE-2023-20592: Improper or unexpected behavior of the INVD instruction in some AMD CPUs may allow an attacker with Improper or unexpected behavior of the INVD instruction in some AMD CPUs may allow an attacker with a malicious hypervisor to affect cache line write-back behavior of the CPU leading to a potential loss of guest virtual machine (VM) memory integrity.

CVE-2023-20575 [MEDIUM] CWE-203 CVE-2023-20575: A potential power side-channel vulnerability in some AMD processors may allow an authenticated atta A potential power side-channel vulnerability in some AMD processors may allow an authenticated attacker to use the power reporting functionality to monitor a program’s execution inside an AMD SEV VM potentially resulting in a leak of sensitive information.

CVE-2023-20569 [MEDIUM] CWE-203 CVE-2023-20569: A side channel vulnerability on some of the AMD CPUs may allow an attacker to influence the retur A side channel vulnerability on some of the AMD CPUs may allow an attacker to influence the return address prediction. This may result in speculative execution at an attacker-controlled address, potentially leading to information disclosure.

CVE-2023-31346 [MEDIUM] CWE-284 CVE-2023-31346: Failure to initialize memory in SEV Firmware may allow a privileged attacker to access stale data fr Failure to initialize memory in SEV Firmware may allow a privileged attacker to access stale data from other guests.

CVE-2022-23830 [MEDIUM] CVE-2022-23830: SMM configuration may not be immutable, as intended, when SNP is enabled resulting in a potential li SMM configuration may not be immutable, as intended, when SNP is enabled resulting in a potential limited loss of guest memory integrity.

CVE-2021-26354 [MEDIUM] CWE-120 CVE-2021-26354: Insufficient bounds checking in ASP may allow an attacker to issue a system call from a compromised Insufficient bounds checking in ASP may allow an attacker to issue a system call from a compromised ABL which may cause arbitrary memory values to be initialized to zero, potentially leading to a loss of integrity.

CVE-2023-31347 [MEDIUM] CWE-682 CVE-2023-31347: Due to a code bug in Secure_TSC, SEV firmware may allow an attacker with high privileges to cause a Due to a code bug in Secure_TSC, SEV firmware may allow an attacker with high privileges to cause a guest to observe an incorrect TSC when Secure TSC is enabled potentially resulting in a loss of guest integrity.

CVE-2021-26371 [MEDIUM] CVE-2021-26371: A compromised or malicious ABL or UApp could send a SHA256 system call to the bootloader, which may A compromised or malicious ABL or UApp could send a SHA256 system call to the bootloader, which may result in exposure of ASP memory to userspace, potentially leading to information disclosure.

CVE-2023-31355 [MEDIUM] CWE-119 CVE-2023-31355: Improper restriction of write operations in SNP firmware could allow a malicious hypervisor to overw Improper restriction of write operations in SNP firmware could allow a malicious hypervisor to overwrite a guest's UMC seed potentially allowing reading of memory from a decommissioned guest.