Insufficient Validation in Elliptic Curve Points in SEV-Legacy Firmware by AMD
CVE-2021-26408

7.1HIGH

Key Information:

Vendor

Amd
Status
1st Gen Amd Epyc™
2nd Gen Amd Epyc™
Vendor
CVE Published:
10 May 2022

What is CVE-2021-26408?

The SEV-legacy firmware from AMD exhibits insufficient validation of elliptic curve points, which can lead to compromised migration processes for SEV-legacy guests. This vulnerability poses potential risks to both the integrity and confidentiality of guest systems, allowing attackers to exploit the flaw and threaten the secure operation of virtualized environments.

Affected Version(s)

1st Gen AMD EPYC™ < unspecified

2nd Gen AMD EPYC™ < unspecified

References

https://www.amd.com/en/corporate/product-security/bulleti...
x_refsource_MISC

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.