High severity · published Nov 9, 2022
CVE-2021-26360
An attacker with local access to the system can make unauthorized modifications of the security configuration of the SOC registers
7.8
CVSS
0.2%
EPSS
No
On KEV
Description
An attacker with local access to the system can make unauthorized modifications of the security configuration of the SOC registers. This could allow potential corruption of AMD secure processor’s encrypted memory contents which may lead to arbitrary code execution in ASP.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 13% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ED
Enterprise Driver · Amd
before 22.10.20 · source: NVD
RP
Radeon Pro Software · Amd
before 22.q2 · source: NVD
RS
Radeon Software · Amd
before 22.5.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-26360
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-26360
Vendor Advisory
https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1029
More from Enterprise Driver
7.8
CVE-2021-26392
Insufficient verification of missing size check in 'LoadModule' may lead to an out-of-bounds write potentially allowing an attacker with privileges to gain code execution of the…
7.8
CVE-2021-26391
Insufficient verification of multiple header signatures while loading a Trusted Application (TA) may allow an attacker with privileges to gain code execution in that TA or the…
7.8
CVE-2020-12931
Improper parameters handling in the AMD Secure Processor (ASP) kernel may allow a privileged attacker to elevate their privileges potentially leading to loss of integrity
7.8
CVE-2020-12930
Improper parameters handling in AMD Secure Processor (ASP) drivers may allow a privileged attacker to elevate their privileges potentially leading to loss of integrity
5.5
CVE-2021-26393
Insufficient memory cleanup in the AMD Secure Processor (ASP) Trusted Execution Environment (TEE) may allow an authenticated attacker with privileges to generate a valid signed TA…