Amd Ryzen 3 5425C Firmware vulnerabilities

CVE-2023-20579 [MEDIUM] CWE-284 CVE-2023-20579: Improper Access Control in the AMD SPI protection feature may allow a user with Ring0 (kernel mode) Improper Access Control in the AMD SPI protection feature may allow a user with Ring0 (kernel mode) privileged access to bypass protections potentially resulting in loss of integrity and availability.

CVE-2023-20558 [HIGH] CWE-670 CVE-2023-20558: Insufficient control flow management in AmdCpmOemSmm may allow a privileged attacker to tamper with Insufficient control flow management in AmdCpmOemSmm may allow a privileged attacker to tamper with the SMM handler potentially leading to an escalation of privileges.

CVE-2023-20559 [HIGH] CWE-691 CVE-2023-20559: Insufficient control flow management in AmdCpmGpioInitSmm may allow a privileged attacker to tamp Insufficient control flow management in AmdCpmGpioInitSmm may allow a privileged attacker to tamper with the SMM handler potentially leading to escalation of privileges.

CVE-2021-26384 [HIGH] CWE-125 CVE-2021-26384: A malformed SMI (System Management Interface) command may allow an attacker to establish a corrupted A malformed SMI (System Management Interface) command may allow an attacker to establish a corrupted SMI Trigger Info data structure, potentially leading to out-of-bounds memory reads and writes when triggering an SMI resulting in a potential loss of resources.

CVE-2021-26382 [MEDIUM] CVE-2021-26382: An attacker with root account privileges can load any legitimately signed firmware image into the Au An attacker with root account privileges can load any legitimately signed firmware image into the Audio Co-Processor (ACP,) irrespective of the respective signing key being declared as usable for authenticating an ACP firmware image, potentially resulting in a denial of service.

CVE-2021-26339 [MEDIUM] CVE-2021-26339: A bug in AMD CPU’s core logic may allow for an attacker, using specific code from an unprivileged VM A bug in AMD CPU’s core logic may allow for an attacker, using specific code from an unprivileged VM, to trigger a CPU core hang resulting in a potential denial of service. AMD believes the specific code includes a specific x86 instruction sequence that would not be generated by compilers.