Insufficient Input Validation in SMU of AMD Products
CVE-2021-26379

9.8CRITICAL

Key Information:

Vendor

Amd
Status
2nd Gen Amd Epyc™
3rd Gen Amd Epyc™
Vendor
CVE Published:
9 May 2023

What is CVE-2021-26379?

The vulnerability arises from inadequate input validation of mailbox data within the System Management Unit (SMU), which may enable attackers to manipulate SMRAM, potentially compromising system integrity and allowing for privilege escalation.

Affected Version(s)

2nd Gen AMD EPYC™ x86 various

3rd Gen AMD EPYC™ x86 various

References

https://www.amd.com/en/corporate/product-security/bulleti...
vendor-advisory

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.