Page 2 of 40 results (0.001 seconds)

CVSS: 6.5EPSS: 0%CPEs: 176EXPL: 0

A potential power side-channel vulnerability in some AMD processors may allow an authenticated attacker to use the power reporting functionality to monitor a program’s execution inside an AMD SEV VM potentially resulting in a leak of sensitive information. • https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-3004 • CWE-203: Observable Discrepancy •

CVSS: 9.1EPSS: 0%CPEs: 126EXPL: 0

Insufficient validation of inputs in SVC_MAP_USER_STACK in the ASP (AMD Secure Processor) bootloader may allow an attacker with a malicious Uapp or ABL to send malformed or invalid syscall to the bootloader resulting in a potential denial of service and loss of integrity. • https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-3001 https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-4001 • CWE-20: Improper Input Validation •

CVSS: 7.5EPSS: 0%CPEs: 80EXPL: 0

Insufficient validation in parsing Owner's Certificate Authority (OCA) certificates in SEV (AMD Secure Encrypted Virtualization) and SEV-ES user application can lead to a host crash potentially resulting in denial of service. • https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-3001 https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-4001 •

CVSS: 5.5EPSS: 0%CPEs: 256EXPL: 0

A compromised or malicious ABL or UApp could send a SHA256 system call to the bootloader, which may result in exposure of ASP memory to userspace, potentially leading to information disclosure. • https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-3001 https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-4001 •

CVSS: 7.4EPSS: 0%CPEs: 196EXPL: 0

A TOCTOU in ASP bootloader may allow an attacker to tamper with the SPI ROM following data read to memory potentially resulting in S3 data corruption and information disclosure. • https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-3001 https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-4001 • CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition •