High severity · published Feb 16, 2022
CVE-2021-39298
A potential vulnerability in AMD System Management Mode (SMM) interrupt handler may allow an attacker with high privileges to access the SMM resulting in arbitrary code execution…
8.8
CVSS
0.4%
EPSS
No
On KEV
Description
A potential vulnerability in AMD System Management Mode (SMM) interrupt handler may allow an attacker with high privileges to access the SMM resulting in arbitrary code execution which could be used by malicious actors to bypass security mechanisms provided in the UEFI firmware.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
2G
2nd Gen EPYC · AMD
Various · source: vendor
3G
3rd Gen EPYC · AMD
various · source: vendor
R2
Ryzen 2000 Series · AMD
various · source: vendor
R3
Ryzen 3000 Series · AMD
Various · source: vendor
R5
Ryzen 5000 Series · AMD
various · source: vendor
ED
Elite Dragonfly Firmware · HP
before 01.12.00 · source: NVD
ED
Elite Dragonfly G2 Firmware · HP
before 01.08.00 · source: NVD
ED
Elite Dragonfly Max Firmware · HP
before 01.08.00 · source: NVD
EX
Elite X2 1013 G3 Firmware · HP
before 01.19.00 · source: NVD
EX
Elite X2 G4 Firmware · HP
before 01.12.00 · source: NVD
EX
Elite X2 G8 Tablet Firmware · HP
before 01.08.00 · source: NVD
E1
Elitebook 1050 G1 Firmware · HP
before 01.19.00 · source: NVD