CVSS: 7.8EPSS: 0%CPEs: 80EXPL: 0CVE-2021-26406
https://notcve.org/view.php?id=CVE-2021-26406
09 May 2023 — Insufficient validation in parsing Owner's Certificate Authority (OCA) certificates in SEV (AMD Secure Encrypted Virtualization) and SEV-ES user application can lead to a host crash potentially resulting in denial of service. Insufficient validation in parsing Owner's Certificate Authority (OCA) certificates in SEV (AMD Secure Encrypted Virtualization) and SEV-ES user application can lead to a host crash potentially resulting in denial of service. • https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-3001 •
CVSS: 5.5EPSS: 0%CPEs: 256EXPL: 0CVE-2021-26371
https://notcve.org/view.php?id=CVE-2021-26371
09 May 2023 — A compromised or malicious ABL or UApp could send a SHA256 system call to the bootloader, which may result in exposure of ASP memory to userspace, potentially leading to information disclosure. A compromised or malicious ABL or UApp could send a SHA256 system call to the bootloader, which may result in exposure of ASP memory to userspace, potentially leading to information disclosure. • https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-3001 •
CVSS: 5.5EPSS: 0%CPEs: 304EXPL: 0CVE-2021-26354
https://notcve.org/view.php?id=CVE-2021-26354
09 May 2023 — Insufficient bounds checking in ASP may allow an attacker to issue a system call from a compromised ABL which may cause arbitrary memory values to be initialized to zero, potentially leading to a loss of integrity. Insufficient bounds checking in ASP may allow an attacker to issue a system call from a compromised ABL which may cause arbitrary memory values to be initialized to zero, potentially leading to a loss of integrity. • https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-3001 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 7.8EPSS: 0%CPEs: 96EXPL: 0CVE-2023-20524
https://notcve.org/view.php?id=CVE-2023-20524
09 May 2023 — An attacker with a compromised ASP could possibly send malformed commands to an ASP on another CPU, resulting in an out of bounds write, potentially leading to a loss a loss of integrity. An attacker with a compromised ASP could possibly send malformed commands to an ASP on another CPU, resulting in an out of bounds write, potentially leading to a loss a loss of integrity. • https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-3001 • CWE-787: Out-of-bounds Write •
CVSS: 10.0EPSS: 0%CPEs: 126EXPL: 0CVE-2023-20520
https://notcve.org/view.php?id=CVE-2023-20520
09 May 2023 — Improper access control settings in ASP Bootloader may allow an attacker to corrupt the return address causing a stack-based buffer overrun potentially leading to arbitrary code execution. Improper access control settings in ASP Bootloader may allow an attacker to corrupt the return address causing a stack-based buffer overrun potentially leading to arbitrary code execution. • https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-3001 • CWE-787: Out-of-bounds Write •
CVSS: 7.2EPSS: 0%CPEs: 96EXPL: 0CVE-2021-46775
https://notcve.org/view.php?id=CVE-2021-46775
09 May 2023 — Improper input validation in ABL may enable an attacker with physical access, to perform arbitrary memory overwrites, potentially leading to a loss of integrity and code execution. Improper input validation in ABL may enable an attacker with physical access, to perform arbitrary memory overwrites, potentially leading to a loss of integrity and code execution. • https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-3001 • CWE-20: Improper Input Validation •
CVSS: 9.0EPSS: 0%CPEs: 96EXPL: 0CVE-2021-46769
https://notcve.org/view.php?id=CVE-2021-46769
09 May 2023 — Insufficient syscall input validation in the ASP Bootloader may allow a privileged attacker to execute arbitrary DMA copies, which can lead to code execution. Insufficient syscall input validation in the ASP Bootloader may allow a privileged attacker to execute arbitrary DMA copies, which can lead to code execution. • https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-3001 • CWE-20: Improper Input Validation •
CVSS: 7.8EPSS: 0%CPEs: 96EXPL: 0CVE-2021-46764
https://notcve.org/view.php?id=CVE-2021-46764
09 May 2023 — Improper validation of DRAM addresses in SMU may allow an attacker to overwrite sensitive memory locations within the ASP potentially resulting in a denial of service. Improper validation of DRAM addresses in SMU may allow an attacker to overwrite sensitive memory locations within the ASP potentially resulting in a denial of service. • https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-3001 • CWE-787: Out-of-bounds Write •
CVSS: 7.8EPSS: 0%CPEs: 96EXPL: 0CVE-2021-46763
https://notcve.org/view.php?id=CVE-2021-46763
09 May 2023 — Insufficient input validation in the SMU may enable a privileged attacker to write beyond the intended bounds of a shared memory buffer potentially leading to a loss of integrity. Insufficient input validation in the SMU may enable a privileged attacker to write beyond the intended bounds of a shared memory buffer potentially leading to a loss of integrity. • https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-3001 • CWE-787: Out-of-bounds Write •
CVSS: 9.4EPSS: 0%CPEs: 96EXPL: 0CVE-2021-46762
https://notcve.org/view.php?id=CVE-2021-46762
09 May 2023 — Insufficient input validation in the SMU may allow an attacker to corrupt SMU SRAM potentially leading to a loss of integrity or denial of service. Insufficient input validation in the SMU may allow an attacker to corrupt SMU SRAM potentially leading to a loss of integrity or denial of service. • https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-3001 • CWE-20: Improper Input Validation •