CVSS: 7.0EPSS: 0%CPEs: 128EXPL: 0CVE-2022-23817
https://notcve.org/view.php?id=CVE-2022-23817
13 Aug 2024 — Insufficient checking of memory buffer in ASP Secure OS may allow an attacker with a malicious TA to read/write to the ASP Secure OS kernel virtual address space, potentially leading to privilege escalation. • https://www.amd.com/en/resources/product-security/bulletin/amd-sb-4004.html • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 10.0EPSS: 0%CPEs: 236EXPL: 0CVE-2022-23821
https://notcve.org/view.php?id=CVE-2022-23821
14 Nov 2023 — Improper access control in System Management Mode (SMM) may allow an attacker to write to SPI ROM potentially leading to arbitrary code execution. Un control de acceso inadecuado en System Management Mode (SMM) puede permitir que un atacante escriba en la ROM SPI, lo que podría provocar la ejecución de código arbitrario. • https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-4002 •
CVSS: 7.8EPSS: 0%CPEs: 172EXPL: 0CVE-2023-20533
https://notcve.org/view.php?id=CVE-2023-20533
14 Nov 2023 — Insufficient DRAM address validation in System Management Unit (SMU) may allow an attacker to read/write from/to an invalid DRAM address, potentially resulting in denial-of-service. Una validación de dirección DRAM insuficiente en System Management Unit (SMU) puede permitir que un atacante lea/escriba desde/hacia una dirección DRAM no válida, lo que podría provocar una denegación de servicio. Insufficient DRAM address validation in System Management Unit (SMU) may allow an attacker to read/write from/to an ... • https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-3002 •
CVSS: 10.0EPSS: 0%CPEs: 230EXPL: 0CVE-2022-23820
https://notcve.org/view.php?id=CVE-2022-23820
14 Nov 2023 — Failure to validate the AMD SMM communication buffer may allow an attacker to corrupt the SMRAM potentially leading to arbitrary code execution. No validar el búfer de comunicación AMD SMM puede permitir que un atacante corrompa la SMRAM, lo que podría provocar la ejecución de código arbitrario. Failure to validate the AMD SMM communication buffer may allow an attacker to corrupt the SMRAM potentially leading to arbitrary code execution. • https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-3002 • CWE-20: Improper Input Validation •
CVSS: 7.8EPSS: 0%CPEs: 274EXPL: 0CVE-2021-46774
https://notcve.org/view.php?id=CVE-2021-46774
14 Nov 2023 — Insufficient DRAM address validation in System Management Unit (SMU) may allow an attacker to read/write from/to an invalid DRAM address, potentially resulting in denial-of-service. Una validación de dirección DRAM insuficiente en System Management Unit (SMU) puede permitir que un atacante lea/escriba desde/hacia una dirección DRAM no válida, lo que podría provocar una denegación de servicio. Insufficient DRAM address validation in System Management Unit (SMU) may allow an attacker to read/write from/to an ... • https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-3002 •
CVSS: 5.5EPSS: 0%CPEs: 56EXPL: 0CVE-2021-46766
https://notcve.org/view.php?id=CVE-2021-46766
14 Nov 2023 — Improper clearing of sensitive data in the ASP Bootloader may expose secret keys to a privileged attacker accessing ASP SRAM, potentially leading to a loss of confidentiality. La limpieza inadecuada de datos confidenciales en el ASP Bootloader puede exponer claves secretas a un atacante privilegiado que acceda a ASP SRAM, lo que podría provocar una pérdida de confidencialidad. • https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-3002 • CWE-459: Incomplete Cleanup •
CVSS: 5.5EPSS: 0%CPEs: 319EXPL: 0CVE-2023-20597
https://notcve.org/view.php?id=CVE-2023-20597
20 Sep 2023 — Improper initialization of variables in the DXE driver may allow a privileged user to leak sensitive information via local access. La inicialización incorrecta de variables en el controlador DXE puede permitir que un usuario privilegiado filtre información sensible a través del acceso local. • https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-4007 • CWE-665: Improper Initialization •
CVSS: 4.4EPSS: 0%CPEs: 381EXPL: 0CVE-2023-20594
https://notcve.org/view.php?id=CVE-2023-20594
20 Sep 2023 — Improper initialization of variables in the DXE driver may allow a privileged user to leak sensitive information via local access. La inicialización incorrecta de variables en el controlador DXE puede permitir que un usuario privilegiado filtre información sensible a través del acceso local. • https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-4007 • CWE-665: Improper Initialization •
CVSS: 7.2EPSS: 0%CPEs: 244EXPL: 0CVE-2023-20589 – fTPM Voltage Fault Injection
https://notcve.org/view.php?id=CVE-2023-20589
08 Aug 2023 — An attacker with specialized hardware and physical access to an impacted device may be able to perform a voltage fault injection attack resulting in compromise of the ASP secure boot potentially leading to arbitrary code execution. • https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-4005 •
CVSS: 6.5EPSS: 6%CPEs: 145EXPL: 2CVE-2023-20593 – hw: amd: Cross-Process Information Leak
https://notcve.org/view.php?id=CVE-2023-20593
24 Jul 2023 — An issue in “Zen 2” CPUs, under specific microarchitectural circumstances, may allow an attacker to potentially access sensitive information. A flaw was found in hw, in “Zen 2” CPUs. This issue may allow an attacker to access sensitive information under specific microarchitectural circumstances. Daniel Moghimi discovered that some Intel Processors did not properly clear microarchitectural state after speculative execution of various instructions. A local unprivileged user could use this to obtain to sensiti... • https://github.com/sbaresearch/stop-zenbleed-win • CWE-209: Generation of Error Message Containing Sensitive Information CWE-1239: Improper Zeroization of Hardware Register •