CVSS: 9.8EPSS: 0%CPEs: 236EXPL: 0CVE-2022-23821
https://notcve.org/view.php?id=CVE-2022-23821
Improper access control in System Management Mode (SMM) may allow an attacker to write to SPI ROM potentially leading to arbitrary code execution. Un control de acceso inadecuado en System Management Mode (SMM) puede permitir que un atacante escriba en la ROM SPI, lo que podría provocar la ejecución de código arbitrario. • https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-4002 https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-5001 •
CVSS: 9.8EPSS: 0%CPEs: 230EXPL: 0CVE-2022-23820
https://notcve.org/view.php?id=CVE-2022-23820
Failure to validate the AMD SMM communication buffer may allow an attacker to corrupt the SMRAM potentially leading to arbitrary code execution. No validar el búfer de comunicación AMD SMM puede permitir que un atacante corrompa la SMRAM, lo que podría provocar la ejecución de código arbitrario. • https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-3002 https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-4002 https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-5001 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 336EXPL: 0CVE-2021-46794
https://notcve.org/view.php?id=CVE-2021-46794
Insufficient bounds checking in ASP (AMD Secure Processor) may allow for an out of bounds read in SMI (System Management Interface) mailbox checksum calculation triggering a data abort, resulting in a potential denial of service. • https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-4001 • CWE-125: Out-of-bounds Read •
CVSS: 7.5EPSS: 0%CPEs: 156EXPL: 0CVE-2021-46765
https://notcve.org/view.php?id=CVE-2021-46765
Insufficient input validation in ASP may allow an attacker with a compromised SMM to induce out-of-bounds memory reads within the ASP, potentially leading to a denial of service. • https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-4001 • CWE-125: Out-of-bounds Read •
CVSS: 6.1EPSS: 0%CPEs: 378EXPL: 0CVE-2021-46759
https://notcve.org/view.php?id=CVE-2021-46759
Improper syscall input validation in AMD TEE (Trusted Execution Environment) may allow an attacker with physical access and control of a Uapp that runs under the bootloader to reveal the contents of the ASP (AMD Secure Processor) bootloader accessible memory to a serial port, resulting in a potential loss of integrity. • https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-4001 • CWE-787: Out-of-bounds Write •