High severity · published May 9, 2023
CVE-2021-26356
A TOCTOU in ASP bootloader may allow an attacker to tamper with the SPI ROM following data read to memory potentially resulting in S3 data corruption and information disclosure
7.4
CVSS
0.4%
EPSS
No
On KEV
Description
A TOCTOU in ASP bootloader may allow an attacker
to tamper with the SPI ROM following data read to memory potentially resulting
in S3 data corruption and information disclosure.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
E7
Epyc 7001 Firmware · Amd
before naplespi_1.0.0.h · source: NVD
E7
Epyc 7002 Firmware · Amd
before romepi_1.0.0.d · source: NVD
E7
Epyc 7232p Firmware · Amd
before romepi_1.0.0.d · source: NVD
E7
Epyc 7251 Firmware · Amd
before naplespi_1.0.0.h · source: NVD
E7
Epyc 7252 Firmware · Amd
before romepi_1.0.0.d · source: NVD
E7
Epyc 7261 Firmware · Amd
before naplespi_1.0.0.h · source: NVD
E7
Epyc 7262 Firmware · Amd
before romepi_1.0.0.d · source: NVD
E7
Epyc 7272 Firmware · Amd
before romepi_1.0.0.d · source: NVD
E7
Epyc 7281 Firmware · Amd
before naplespi_1.0.0.h · source: NVD
E7
Epyc 7282 Firmware · Amd
before romepi_1.0.0.d · source: NVD
E7
Epyc 7301 Firmware · Amd
before naplespi_1.0.0.h · source: NVD
E7
Epyc 7302 Firmware · Amd
before romepi_1.0.0.d · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-26356
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-26356
Vendor Advisory
https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-3001
Vendor Advisory
https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-4001
More from Epyc 7001 Firmware
8.4
CVE-2021-26340
A malicious hypervisor in conjunction with an unprivileged attacker process inside an SEV/SEV-ES guest VM may fail to flush the Translation Lookaside Buffer (TLB) resulting in…
7.8
CVE-2021-26398
Insufficient input validation in SYS_KEY_DERIVE system call in a compromised user application or ABL may allow an attacker to corrupt ASP (AMD Secure Processor) OS memory which…
7.8
CVE-2021-26335
Improper input and range checking in the AMD Secure Processor (ASP) boot loader image header may allow an attacker to use attacker-controlled values prior to signature validation…
7.8
CVE-2021-26331
AMD System Management Unit (SMU) contains a potential issue where a malicious user may be able to manipulate mailbox entries leading to arbitrary code execution
7.5
CVE-2021-46774
Insufficient DRAM address validation in System Management Unit (SMU) may allow an attacker to read/write from/to an invalid DRAM address, potentially resulting in…