AMD Epyc Embedded 7281 Firmware vulnerabilities

4 CVEs affecting AMD Epyc Embedded 7281 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-27672, published 2023-03-01.

More from AMD.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2021-46744, published 2022-05-11. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. An attacker with access to a malicious hypervisor may be able to infer data values used in a SEV guest on AMD CPUs by monitoring ciphertext values over time.
• CVE-2020-12966, published 2022-02-04. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. AMD EPYC™ Processors contain an information disclosure vulnerability in the Secure Encrypted Virtualization with Encrypted State (SEV-ES) and Secure Encrypted Virtualization with Secure Nested Paging…
• CVE-2022-27672, published 2023-03-01. Medium severity, CVSS 4.7. EPSS: 0.3% chance of exploitation in the next 30 days. When SMT is enabled, certain AMD processors may speculatively execute instructions using a target from the sibling thread after an SMT mode switch potentially resulting in information disclosure.
• CVE-2021-26340, published 2021-12-10. High severity, CVSS 8.4. EPSS: 0.2% chance of exploitation in the next 30 days. A malicious hypervisor in conjunction with an unprivileged attacker process inside an SEV/SEV-ES guest VM may fail to flush the Translation Lookaside Buffer (TLB) resulting in unexpected behavior…