CVSS: 7.8EPSS: 0%CPEs: 264EXPL: 0CVE-2023-20555
https://notcve.org/view.php?id=CVE-2023-20555
08 Aug 2023 — Insufficient input validation in CpmDisplayFeatureSmm may allow an attacker to corrupt SMM memory by overwriting an arbitrary bit in an attacker-controlled pointer potentially leading to arbitrary code execution in SMM. Insufficient input validation in CpmDisplayFeatureSmm may allow an attacker to corrupt SMM memory by overwriting an arbitrary bit in an attacker-controlled pointer potentially leading to arbitrary code execution in SMM. • https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-4003 • CWE-787: Out-of-bounds Write •
CVSS: 7.2EPSS: 0%CPEs: 244EXPL: 0CVE-2023-20589 – fTPM Voltage Fault Injection
https://notcve.org/view.php?id=CVE-2023-20589
08 Aug 2023 — An attacker with specialized hardware and physical access to an impacted device may be able to perform a voltage fault injection attack resulting in compromise of the ASP secure boot potentially leading to arbitrary code execution. • https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-4005 •
CVSS: 4.7EPSS: 0%CPEs: 340EXPL: 0CVE-2022-27672 – kernel: AMD: Cross-Thread Return Address Predictions
https://notcve.org/view.php?id=CVE-2022-27672
14 Feb 2023 — When SMT is enabled, certain AMD processors may speculatively execute instructions using a target from the sibling thread after an SMT mode switch potentially resulting in information disclosure. A flaw was found in HW. When SMT is enabled, certain AMD processors may speculatively execute instructions using a target from the sibling thread after an SMT mode switch, potentially resulting in information disclosure. When SMT is enabled, certain AMD processors may speculatively execute instructions using a targ... • https://security.gentoo.org/glsa/202402-07 •
CVSS: 7.8EPSS: 0%CPEs: 294EXPL: 0CVE-2021-26316
https://notcve.org/view.php?id=CVE-2021-26316
10 Jan 2023 — Failure to validate the communication buffer and communication service in the BIOS may allow an attacker to tamper with the buffer resulting in potential SMM (System Management Mode) arbitrary code execution. • https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1031 • CWE-20: Improper Input Validation •
CVSS: 7.8EPSS: 0%CPEs: 252EXPL: 0CVE-2021-26392
https://notcve.org/view.php?id=CVE-2021-26392
09 Nov 2022 — Insufficient verification of missing size check in 'LoadModule' may lead to an out-of-bounds write potentially allowing an attacker with privileges to gain code execution of the OS/kernel by loading a malicious TA. Una verificación insuficiente del tamaño faltante en 'LoadModule' puede provocar una escritura fuera de límites que podría permitir que un atacante con privilegios obtenga la ejecución de código del sistema operativo/kernel cargando un TA malicioso. • https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1029 • CWE-787: Out-of-bounds Write •
CVSS: 7.8EPSS: 0%CPEs: 231EXPL: 0CVE-2020-12930
https://notcve.org/view.php?id=CVE-2020-12930
09 Nov 2022 — Improper parameters handling in AMD Secure Processor (ASP) drivers may allow a privileged attacker to elevate their privileges potentially leading to loss of integrity. El manejo inadecuado de los parámetros en los controladores del AMD Secure Processor (ASP) puede permitir que un atacante privilegiado eleve sus privilegios, lo que podría provocar una pérdida de integridad. • https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1029 •
CVSS: 5.5EPSS: 0%CPEs: 180EXPL: 0CVE-2021-26393
https://notcve.org/view.php?id=CVE-2021-26393
09 Nov 2022 — Insufficient memory cleanup in the AMD Secure Processor (ASP) Trusted Execution Environment (TEE) may allow an authenticated attacker with privileges to generate a valid signed TA and potentially poison the contents of the process memory with attacker controlled data resulting in a loss of confidentiality. Una limpieza de memoria insuficiente en AMD Secure Processor (ASP) Trusted Execution Environment (TEE) puede permitir que un atacante autenticado con privilegios genere un TA firmado válido y potencialmen... • https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1029 • CWE-401: Missing Release of Memory after Effective Lifetime •
CVSS: 7.8EPSS: 0%CPEs: 227EXPL: 0CVE-2020-12931
https://notcve.org/view.php?id=CVE-2020-12931
09 Nov 2022 — Improper parameters handling in the AMD Secure Processor (ASP) kernel may allow a privileged attacker to elevate their privileges potentially leading to loss of integrity. El manejo inadecuado de los parámetros en el kernel del AMD Secure Processor (ASP) puede permitir que un atacante privilegiado eleve sus privilegios, lo que podría provocar una pérdida de integridad. • https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1029 •