AMD Epyc 7003 Firmware vulnerabilities

34 CVEs affecting AMD Epyc 7003 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-20594, published 2023-09-20.

More from AMD.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2020-12988, published 2021-06-11. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. A potential denial of service (DoS) vulnerability exists in the integrated chipset that may allow a malicious attacker to hang the system when it is rebooted.
• CVE-2023-20531, published 2023-01-11. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. Insufficient bound checks in the SMU may allow an attacker to update the SRAM from/to address space to an invalid value potentially resulting in a denial of service.
• CVE-2023-20530, published 2023-01-11. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. Insufficient input validation of BIOS mailbox messages in SMU may result in out-of-bounds memory reads potentially resulting in a denial of service.
• CVE-2023-20529, published 2023-01-11. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. Insufficient bound checks in the SMU may allow an attacker to update the from/to address space to an invalid value potentially resulting in a denial of service.
• CVE-2022-23824, published 2022-11-09. Medium severity, CVSS 5.5. EPSS: 0.6% chance of exploitation in the next 30 days. IBPB may not prevent return branch predictions from being specified by pre-IBPB branch targets leading to a potential information disclosure.
• CVE-2023-20527, published 2023-01-11. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. Improper syscall input validation in the ASP Bootloader may allow a privileged attacker to read memory out-of-bounds, potentially leading to a denial-of-service.
• CVE-2023-20525, published 2023-01-11. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. Insufficient syscall input validation in the ASP Bootloader may allow a privileged attacker to read memory outside the bounds of a mapped register potentially leading to a denial of service.
• CVE-2023-20532, published 2023-01-11. Medium severity, CVSS 5.3. EPSS: 0.6% chance of exploitation in the next 30 days. Insufficient input validation in the SMU may allow an attacker to improperly lock resources, potentially resulting in a denial of service.
• CVE-2021-46744, published 2022-05-11. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. An attacker with access to a malicious hypervisor may be able to infer data values used in a SEV guest on AMD CPUs by monitoring ciphertext values over time.
• CVE-2020-12966, published 2022-02-04. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. AMD EPYC™ Processors contain an information disclosure vulnerability in the Secure Encrypted Virtualization with Encrypted State (SEV-ES) and Secure Encrypted Virtualization with Secure Nested Paging…

Latest

• CVE-2023-20594, published 2023-09-20. Medium severity, CVSS 4.4. EPSS: 0.2% chance of exploitation in the next 30 days. Improper initialization of variables in the DXE driver may allow a privileged user to leak sensitive information via local access.
• CVE-2021-26371, published 2023-05-09. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. A compromised or malicious ABL or UApp could send a SHA256 system call to the bootloader, which may result in exposure of ASP memory to userspace, potentially leading to information…
• CVE-2021-26354, published 2023-05-09. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. Insufficient bounds checking in ASP may allow an attacker to issue a system call from a compromised ABL which may cause arbitrary memory values to be initialized to zero, potentially leading to…
• CVE-2023-20528, published 2023-01-11. Low severity, CVSS 2.4. EPSS: 0.2% chance of exploitation in the next 30 days. Insufficient input validation in the SMU may allow a physical attacker to exfiltrate SMU memory contents over the I2C bus potentially leading to a loss of confidentiality.