VulnerabilityModified
CVE-2021-26347
Failure to validate the integer operand in ASP (AMD Secure Processor) bootloader may allow an attacker to introduce an integer overflow in the L2 directory table in SPI flash resulting in a potential denial of service.
MEDIUM 4.7EPSS 0.19%
Does this matter?
Lower severity and a low EPSS score (0.19%). Track it; it rarely justifies an emergency change on its own.
Description
Failure to validate the integer operand in ASP (AMD Secure Processor) bootloader may allow an attacker to introduce an integer overflow in the L2 directory table in SPI flash resulting in a potential denial of service.
- CVSS 3.1
- 4.7 MEDIUMCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 0.19% probability · 9th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-1284
- Affected
- amd/epyc 7763 firmware · amd/epyc 7713p firmware · amd/epyc 7713 firmware · amd/epyc 7663 firmware · amd/epyc 7643 firmware · amd/epyc 75f3 firmware · amd/epyc 7543p firmware · amd/epyc 7543 firmware · amd/epyc 7513 firmware · amd/epyc 7453 firmware · amd/epyc 74f3 firmware · amd/epyc 7443p firmware · amd/epyc 7443 firmware · amd/epyc 7413 firmware · amd/epyc 73f3 firmware · amd/epyc 7343 firmware · amd/epyc 7313p firmware · amd/epyc 7313 firmware · amd/epyc 72f3 firmware · amd/epyc 7773x firmware · +29 more
- Source
- psirt@amd.com
References
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.