VulnerabilityModified
CVE-2021-26356
A TOCTOU in ASP bootloader may allow an attacker to tamper with the SPI ROM following data read to memory potentially resulting in S3 data corruption and information disclosure.
HIGH 7.4EPSS 0.40%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.40%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A TOCTOU in ASP bootloader may allow an attacker to tamper with the SPI ROM following data read to memory potentially resulting in S3 data corruption and information disclosure.
- CVSS 3.1
- 7.4 HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
- EPSS
- 0.40% probability · 33th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-367
- Affected
- amd/epyc 7001 firmware · amd/epyc 7251 firmware · amd/epyc 7261 firmware · amd/epyc 7281 firmware · amd/epyc 7301 firmware · amd/epyc 7351 firmware · amd/epyc 7351p firmware · amd/epyc 7371 firmware · amd/epyc 7401 firmware · amd/epyc 7401p firmware · amd/epyc 7451 firmware · amd/epyc 7501 firmware · amd/epyc 7551 firmware · amd/epyc 7551p firmware · amd/epyc 7601 firmware · amd/epyc 7002 firmware · amd/epyc 7232p firmware · amd/epyc 7252 firmware · amd/epyc 7262 firmware · amd/epyc 7272 firmware · +40 more
- Source
- psirt@amd.com
References
- https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-3001Vendor Advisory
- https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-4001Vendor Advisory
- https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-3001Vendor Advisory
- https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-4001Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.