Amd vulnerabilities, page 4
320 vulnerabilities
Known vulnerabilities in Amd products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 1,346 products.
CVE-2021-26373amdathlon™ series+89
EPSS score0.22%
Insufficient bound checks in the System Management Unit (SMU) may result in a system voltage malfunction that could result in denial of resources and/or possibly denial of service.CVE-2021-26348amdepyc_72f3_firmware+23EPSS score0.22%
Failure to flush the Translation Lookaside Buffer (TLB) of the I/O memory management unit (IOMMU) may lead an IO device to write to memory it should not be able to access, resulting in a potential loss of integrity.CVE-2021-26338amd2nd gen amd epyc™+45EPSS score0.93%
Improper access controls in System Management Unit (SMU) may allow for an attacker to override performance control tables located in DRAM resulting in a potential lack of system resources.CVE-2021-26312amdathlon™ series+59EPSS score0.25%
Failure to flush the Translation Lookaside Buffer (TLB) of the I/O memory management unit (IOMMU) may lead an IO device to write to memory it should not be able to access, resulting in a potential loss of integrity.CVE-2021-26330amd1st gen amd epyc™+60EPSS score0.22%
AMD System Management Unit (SMU) may experience a heap-based overflow which may result in a loss of resources.CVE-2021-26375amdathlon™ series+85EPSS score0.22%
Insufficient General Purpose IO (GPIO) bounds check in System Management Unit (SMU) may result in access/updates from/to invalid address space that could result in denial of service.CVE-2021-26368amdathlon™ series+71EPSS score0.14%
Insufficient check of the process type in Trusted OS (TOS) may allow an attacker with privileges to enable a lesser privileged process to unmap memory owned by a higher privileged process resulting in a denial of service.CVE-2021-26325amd3rd gen amd epyc™+20EPSS score0.22%
Insufficient input validation in the SNP_GUEST_REQUEST command may lead to a potential data abort error and a denial of service.CVE-2021-26313amdall supported processors+9EPSS score0.33%
Potential speculative code store bypass in all supported CPU products, in conjunction with software vulnerabilities relating to speculative execution of overwritten instructions, may cause an incorrect speculation and could result in data leakage.CVE-2021-26341amda10-9600p_firmware+125EPSS score0.32%
Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage.CVE-2021-26322amd1st gen amd epyc™+59EPSS score1.05%
Persistent platform private key may not be protected with a random IV leading to a potential “two time pad attack”.CVE-2021-26332amd3rd gen amd epyc™+23EPSS score0.23%
Failure to verify SEV-ES TMR is not in MMIO space, SEV-ES FW could result in a potential loss of integrity or availability.CVE-2021-26371amd1st gen amd epyc™ processors+140EPSS score0.19%
A compromised or malicious ABL or UApp could
send a SHA256 system call to the bootloader, which may result in exposure of
ASP memory to userspace, potentially leading to information disclosure.CVE-2021-26401amda10-9600p_firmware+216EPSS score0.29%
LFENCE/JMP (mitigation V2-2) may not sufficiently mitigate CVE-2017-5715 on some AMD CPUs.CVE-2021-26340amdamd epyc™+105EPSS score0.25%
A malicious hypervisor in conjunction with an unprivileged attacker process inside an SEV/SEV-ES guest VM may fail to flush the Translation Lookaside Buffer (TLB) resulting in unexpected behavior inside the virtual machine (VM).CVE-2021-26320amd1st gen amd epyc™+59EPSS score0.19%
Insufficient validation of the AMD SEV Signing Key (ASK) in the SEND_START command in the SEV Firmware may allow a local authenticated attacker to perform a denial of service of the PSPCVE-2021-26323amd3rd gen amd epyc™+20EPSS score0.25%
Failure to validate SEV Commands while SNP is active may result in a potential impact to memory integrity.CVE-2021-26390amdathlon_300u_firmware+38EPSS score0.24%
A malicious or compromised UApp or ABL may coerce the bootloader into corrupting arbitrary memory potentially leading to loss of integrity of data.CVE-2021-26347amdepyc_7002_firmware+49EPSS score0.20%
Failure to validate the integer operand in ASP (AMD Secure Processor) bootloader may allow an attacker to introduce an integer overflow in the L2 directory table in SPI flash resulting in a potential denial of service.CVE-2021-26346amdryzen_3_3100_firmware+104EPSS score0.21%
Failure to validate the integer operand in ASP (AMD Secure Processor) bootloader may allow an attacker to introduce an integer overflow in the L2 directory table in SPI flash resulting in a potential denial of service.