Medium severity · published Jan 11, 2023
CVE-2021-26343
Insufficient validation in ASP BIOS and DRTM commands may allow malicious supervisor x86 software to disclose the contents of sensitive memory which may result in information…
5.5
CVSS
0.2%
EPSS
No
On KEV
Description
Insufficient validation in ASP BIOS and DRTM commands may allow malicious supervisor x86 software to disclose the contents of sensitive memory which may result in information disclosure.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 9% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
E7
Epyc 7003 Firmware · Amd
before milanpi_1.0.0.3 · source: NVD
E7
Epyc 72f3 Firmware · Amd
before milanpi_1.0.0.3 · source: NVD
E7
Epyc 7313 Firmware · Amd
before milanpi_1.0.0.3 · source: NVD
E7
Epyc 7313p Firmware · Amd
before milanpi_1.0.0.3 · source: NVD
E7
Epyc 7343 Firmware · Amd
before milanpi_1.0.0.3 · source: NVD
E7
Epyc 7373x Firmware · Amd
before milanpi_1.0.0.3 · source: NVD
E7
Epyc 73f3 Firmware · Amd
before milanpi_1.0.0.3 · source: NVD
E7
Epyc 7413 Firmware · Amd
before milanpi_1.0.0.3 · source: NVD
E7
Epyc 7443 Firmware · Amd
before milanpi_1.0.0.3 · source: NVD
E7
Epyc 7443p Firmware · Amd
before milanpi_1.0.0.3 · source: NVD
E7
Epyc 7453 Firmware · Amd
before milanpi_1.0.0.3 · source: NVD
E7
Epyc 74f3 Firmware · Amd
before milanpi_1.0.0.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-26343
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-26343
Vendor Advisory
https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032
More from Epyc 7003 Firmware
10.0
CVE-2023-20591
Improper re-initialization of IOMMU during the DRTM event may permit an untrusted platform configuration to persist, allowing an attacker to read or modify hypervisor memory,…
7.9
CVE-2024-21980
Improper restriction of write operations in SNP firmware could allow a malicious hypervisor to potentially overwrite a guest's memory or UMC seed resulting in loss of…
7.9
CVE-2024-21978
Improper input validation in SEV-SNP could allow a malicious hypervisor to read or overwrite guest memory potentially leading to data leakage or data corruption
7.8
CVE-2021-26398
Insufficient input validation in SYS_KEY_DERIVE system call in a compromised user application or ABL may allow an attacker to corrupt ASP (AMD Secure Processor) OS memory which…
7.8
CVE-2021-26316
Failure to validate the communication buffer and communication service in the BIOS may allow an attacker to tamper with the buffer resulting in potential SMM (System Management…