Amd Ryzen Threadripper 3970X vulnerabilities
39 vulnerabilities
Known vulnerabilities in Amd Ryzen Threadripper 3970X, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2021-26376amdathlon™ series+85
EPSS score0.22%
Insufficient checks in System Management Unit (SMU) FeatureConfig may result in reenabling features potentially resulting in denial of resources and/or denial of service.CVE-2021-26336amdathlon™ series+96EPSS score0.22%
Insufficient bounds checking in System Management Unit (SMU) may cause invalid memory accesses/updates that could result in SMU hang and subsequent failure to service any further requests from other components.CVE-2021-26392amdamd_3015ce_firmware+110EPSS score0.28%
Insufficient verification of missing size check in 'LoadModule' may lead to an out-of-bounds write potentially allowing an attacker with privileges to gain code execution of the OS/kernel by loading a malicious TA.CVE-2021-26317amdathlon_3050ge_firmware+75EPSS score0.29%
Failure to verify the protocol in SMM may allow an attacker to control the protocol and modify SPI flash resulting in a potential arbitrary code execution.CVE-2021-26354amd2nd gen amd epyc™ processors+169EPSS score0.18%
Insufficient bounds checking in ASP may allow an
attacker to issue a system call from a compromised ABL which may cause
arbitrary memory values to be initialized to zero, potentially leading to a
loss of integrity.CVE-2021-26386amdathlon™ series+71EPSS score0.28%
A malicious or compromised UApp or ABL may be used by an attacker to issue a malformed system call to the Stage 2 Bootloader potentially leading to corrupt memory and code execution.CVE-2021-26356amd1st gen amd epyc™ processors+105EPSS score0.40%
A TOCTOU in ASP bootloader may allow an attacker
to tamper with the SPI ROM following data read to memory potentially resulting
in S3 data corruption and information disclosure.CVE-2021-26337amdathlon™ series+113EPSS score0.24%
Insufficient DRAM address validation in System Management Unit (SMU) may result in a DMA read from invalid DRAM address to SRAM resulting in SMU not servicing further requests.CVE-2021-26388amdathlon™ series+108EPSS score0.22%
Improper validation of the BIOS directory may allow for searches to read beyond the directory table copy in RAM, exposing out of bounds memory contents, resulting in a potential denial of service.CVE-2021-26352amdathlon™ series+31EPSS score0.22%
Insufficient bound checks in System Management Unit (SMU) PCIe Hot Plug table may result in access/updates from/to invalid address space that could result in denial of service.CVE-2021-26378amdathlon™ series+85EPSS score0.22%
Insufficient bound checks in the System Management Unit (SMU) may result in access to an invalid address space that could result in denial of service.CVE-2021-26366amdathlon_3050ge_firmware+64EPSS score0.24%
An attacker, who gained elevated privileges via some other vulnerability, may be able to read data from Boot ROM resulting in a loss of system integrity.CVE-2021-26373amdathlon™ series+89EPSS score0.22%
Insufficient bound checks in the System Management Unit (SMU) may result in a system voltage malfunction that could result in denial of resources and/or possibly denial of service.CVE-2021-26375amdathlon™ series+85EPSS score0.22%
Insufficient General Purpose IO (GPIO) bounds check in System Management Unit (SMU) may result in access/updates from/to invalid address space that could result in denial of service.CVE-2021-26368amdathlon™ series+71EPSS score0.14%
Insufficient check of the process type in Trusted OS (TOS) may allow an attacker with privileges to enable a lesser privileged process to unmap memory owned by a higher privileged process resulting in a denial of service.CVE-2021-26341amda10-9600p_firmware+125EPSS score0.32%
Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage.CVE-2021-26371amd1st gen amd epyc™ processors+140EPSS score0.19%
A compromised or malicious ABL or UApp could
send a SHA256 system call to the bootloader, which may result in exposure of
ASP memory to userspace, potentially leading to information disclosure.CVE-2021-26401amda10-9600p_firmware+216EPSS score0.29%
LFENCE/JMP (mitigation V2-2) may not sufficiently mitigate CVE-2017-5715 on some AMD CPUs.CVE-2021-26390amdathlon_300u_firmware+38EPSS score0.24%
A malicious or compromised UApp or ABL may coerce the bootloader into corrupting arbitrary memory potentially leading to loss of integrity of data.CVE-2021-26351amdathlon™ series+50EPSS score0.21%
Insufficient DRAM address validation in System Management Unit (SMU) may result in a DMA (Direct Memory Access) read/write from/to invalid DRAM address that could result in denial of service.