AMD Epyc 7002 Firmware vulnerabilities

33 CVEs affecting AMD Epyc 7002 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-26371, published 2023-05-09.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-29900, published 2022-07-12. Medium severity, CVSS 6.5. EPSS: 3.9% chance of exploitation in the next 30 days. Mis-trained branch predictions for return instructions may allow arbitrary speculative code execution under certain microarchitecture-dependent conditions.
CVE-2022-23823, published 2022-06-15. Medium severity, CVSS 6.5. EPSS: 1.2% chance of exploitation in the next 30 days. A potential vulnerability in some AMD processors using frequency scaling may allow an authenticated attacker to execute a timing attack to potentially enable information disclosure.
CVE-2020-12988, published 2021-06-11. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. A potential denial of service (DoS) vulnerability exists in the integrated chipset that may allow a malicious attacker to hang the system when it is rebooted.
CVE-2022-23825, published 2022-07-14. Medium severity, CVSS 6.5. EPSS: 0.8% chance of exploitation in the next 30 days. Aliases in the branch predictor may cause some AMD processors to predict the wrong branch type potentially leading to information disclosure.
CVE-2023-20531, published 2023-01-11. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. Insufficient bound checks in the SMU may allow an attacker to update the SRAM from/to address space to an invalid value potentially resulting in a denial of service.
CVE-2023-20529, published 2023-01-11. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. Insufficient bound checks in the SMU may allow an attacker to update the from/to address space to an invalid value potentially resulting in a denial of service.
CVE-2022-23824, published 2022-11-09. Medium severity, CVSS 5.5. EPSS: 0.6% chance of exploitation in the next 30 days. IBPB may not prevent return branch predictions from being specified by pre-IBPB branch targets leading to a potential information disclosure.
CVE-2023-20527, published 2023-01-11. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. Improper syscall input validation in the ASP Bootloader may allow a privileged attacker to read memory out-of-bounds, potentially leading to a denial-of-service.
CVE-2023-20525, published 2023-01-11. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. Insufficient syscall input validation in the ASP Bootloader may allow a privileged attacker to read memory outside the bounds of a mapped register potentially leading to a denial of service.
CVE-2023-20532, published 2023-01-11. Medium severity, CVSS 5.3. EPSS: 0.6% chance of exploitation in the next 30 days. Insufficient input validation in the SMU may allow an attacker to improperly lock resources, potentially resulting in a denial of service.

Latest

CVE-2021-26371, published 2023-05-09. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. A compromised or malicious ABL or UApp could send a SHA256 system call to the bootloader, which may result in exposure of ASP memory to userspace, potentially leading to information…
CVE-2021-26356, published 2023-05-09. High severity, CVSS 7.4. EPSS: 0.4% chance of exploitation in the next 30 days. A TOCTOU in ASP bootloader may allow an attacker to tamper with the SPI ROM following data read to memory potentially resulting in S3 data corruption and information disclosure.
CVE-2021-26354, published 2023-05-09. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. Insufficient bounds checking in ASP may allow an attacker to issue a system call from a compromised ABL which may cause arbitrary memory values to be initialized to zero, potentially leading to…
CVE-2023-20528, published 2023-01-11. Low severity, CVSS 2.4. EPSS: 0.2% chance of exploitation in the next 30 days. Insufficient input validation in the SMU may allow a physical attacker to exfiltrate SMU memory contents over the I2C bus potentially leading to a loss of confidentiality.
CVE-2023-20523, published 2023-01-11. Medium severity, CVSS 5.7. EPSS: 0.2% chance of exploitation in the next 30 days. TOCTOU in the ASP may allow a physical attacker to write beyond the buffer bounds, potentially leading to a loss of integrity or denial of service.