CVE-2021-26314: amd all supported processors Observable Timing Discrepancy
Vulnerability summary
CVE-2021-26314 is a medium (CVSS 5.5) Observable Timing Discrepancy vulnerability in amd all supported processors. EPSS estimates a 0.61% chance of exploitation in the next 30 days, higher than 47.9% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 09-06-2021PublishedVulnerability first disclosed.
- 17-09-2024Last modifiedVulnerability information updated.
Description
Potential floating point value injection in all supported CPU products, in conjunction with software vulnerabilities relating to speculative execution with incorrect floating point results, may cause the use of incorrect data from FPVI and may result in data leakage.
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
0.61%
Chance of exploitation in the next 30 days
Percentile
48%
Versus all other CVEs
30-day change
0.00 pp
From 0.61% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (openwall.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-208Observable Timing DiscrepancyTwo separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.
- CWE-203Observable DiscrepancyThe product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.
Affected systems
Intel4 products
Amd1 product
- all supported processors≥ unspecified, < undefined
Arm1 product
Broadcom1 product
- bcm2711na
Fedoraproject1 product
- fedoraEOL33 | 34
Ubuntu1 product
- xenAll versions (No fix recorded)
6 vendors · 9 products
References
7 links- www.openwall.com/lists/oss-security/2021/06/09/2Mailing ListX Refsource MLISTREPORTThird Party Advisory
- www.openwall.com/lists/oss-security/2021/06/10/1Mailing ListX Refsource MLISTREPORTExploitThird Party Advisory