AMD Epyc Embedded 9654p Firmware vulnerabilities

3 CVEs affecting AMD Epyc Embedded 9654p Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-21980, published 2024-08-05.

More from AMD.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2024-21978, published 2024-08-05. High severity, CVSS 7.9. EPSS: 0.5% chance of exploitation in the next 30 days. Improper input validation in SEV-SNP could allow a malicious hypervisor to read or overwrite guest memory potentially leading to data leakage or data corruption.
• CVE-2024-21980, published 2024-08-05. High severity, CVSS 7.9. EPSS: 0.4% chance of exploitation in the next 30 days. Improper restriction of write operations in SNP firmware could allow a malicious hypervisor to potentially overwrite a guest's memory or UMC seed resulting in loss of confidentiality and integrity.
• CVE-2023-31355, published 2024-08-05. Medium severity, CVSS 6.0. EPSS: 0.4% chance of exploitation in the next 30 days. Improper restriction of write operations in SNP firmware could allow a malicious hypervisor to overwrite a guest's UMC seed potentially allowing reading of memory from a decommissioned guest.