Login Request a demo
High severity · published Jan 11, 2023
CVE-2021-26316
Failure to validate the communication buffer and communication service in the BIOS may allow an attacker to tamper with the buffer resulting in potential SMM (System Management…
7.8
CVSS
0.3%
EPSS
No
On KEV
Description
Failure to validate the communication buffer and communication service in the BIOS may allow an attacker to tamper with the buffer resulting in potential SMM (System Management Mode) arbitrary code execution.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 19% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
A3
Athlon 3050ge Firmware · Amd
All versions, or not specified · source: NVD
A3
Athlon 3150g Firmware · Amd
All versions, or not specified · source: NVD
A3
Athlon 3150ge Firmware · Amd
All versions, or not specified · source: NVD
AG
Athlon Gold 3150c Firmware · Amd
All versions, or not specified · source: NVD
AG
Athlon Gold 3150ge Firmware · Amd
All versions, or not specified · source: NVD
AG
Athlon Gold 3150u Firmware · Amd
All versions, or not specified · source: NVD
AG
Athlon Gold Pro 3150g Firmware · Amd
All versions, or not specified · source: NVD
AG
Athlon Gold Pro 3150ge Firmware · Amd
All versions, or not specified · source: NVD
AP
Athlon Pro 3045b Firmware · Amd
All versions, or not specified · source: NVD
AP
Athlon Pro 3145b Firmware · Amd
All versions, or not specified · source: NVD
E7
Epyc 7002 Firmware · Amd
before romepi_1.0.0.d · source: NVD
E7
Epyc 7003 Firmware · Amd
before milanpi-sp3_1.0.0.8 · source: NVD
Affected product
A3
Athlon 3050ge Firmware
Amd
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-26316
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-26316
Vendor Advisory
https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1031
Vendor Advisory
https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032
More from Athlon 3050ge Firmware
7.8
CVE-2021-26317
Failure to verify the protocol in SMM may allow an attacker to control the protocol and modify SPI flash resulting in a potential arbitrary code execution
7.8
CVE-2021-26369
A malicious or compromised UApp or ABL may be used by an attacker to send a malformed system call to the bootloader, resulting in out-of-bounds memory accesses
7.1
CVE-2021-26366
An attacker, who gained elevated privileges via some other vulnerability, may be able to read data from Boot ROM resulting in a loss of system integrity
7.1
CVE-2021-26362
A malicious or compromised UApp or ABL may be used by an attacker to issue a malformed system call which results in mapping sensitive System Management Network (SMN) registers…
5.6
CVE-2021-46778
Execution unit scheduler contention may lead to a side channel vulnerability found on AMD CPU microarchitectures codenamed “Zen 1”, “Zen 2” and “Zen 3” that use simultaneous…