CVE-2021-26318: amd all supported processors Observable Timing Discrepancy
CVSS: 4.7v3.1MediumModified
AliasesUBUNTU-CVE-2021-26318
Published 13-10-2021Last modified 16-09-2024
Vulnerability summary
CVE-2021-26318 is a medium (CVSS 4.7) Observable Timing Discrepancy vulnerability in amd all supported processors. EPSS estimates a 0.33% chance of exploitation in the next 30 days, higher than 24.3% of scored vulnerabilities.
CVSS score
4.7/10
010
Medium · v3.1 (NVD)EPSS score
0.33%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 13-10-2021PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
A timing and power-based side channel attack leveraging the x86 PREFETCH instructions on some AMD CPUs could potentially result in leaked kernel address space information.
CVSS metrics
3 scores · 2 sources · 2 versionsMedium 4.7Preferred score · NVD (NIST)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:NSourcesAll 2 agree
- OSV · UbuntuEcosystem advisory · calculated4.7MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Low 1.9Preferred score · NVD (NIST)
AV:L/AC:M/Au:N/C:P/I:N/A:NSourcesSingle source
EPSS trend
Probability
0.33%
Chance of exploitation in the next 30 days
Percentile
24%
Versus all other CVEs
30-day change
0.00 pp
From 0.33% on 19-09-2026
19-09-202619-10-2026
EPSS score0.33%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-208Observable Timing DiscrepancyTwo separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.
- CWE-203Observable DiscrepancyThe product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.
Affected systems
Amd6 products
- all supported processors≥ unspecified, < undefined
- athlon_firmwarena
- athlon_pro_firmwarena
- epyc_firmwarena
- ryzen_firmwarena
Ubuntu1 product
- amd64-microcodeAll versions (No fix recorded)
2 vendors · 7 products