AMD Ryzen Threadripper 1920x Firmware vulnerabilities

7 CVEs affecting AMD Ryzen Threadripper 1920x Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-26388, published 2022-05-11.

More from AMD.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2020-12965, published 2022-02-04. High severity, CVSS 7.5. EPSS: 2.4% chance of exploitation in the next 30 days. When combined with specific software sequences, AMD CPUs may transiently execute non-canonical loads and store using only the lower 48 address bits potentially resulting in data leakage.
• CVE-2021-26375, published 2022-05-11. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. Insufficient General Purpose IO (GPIO) bounds check in System Management Unit (SMU) may result in access/updates from/to invalid address space that could result in denial of service.
• CVE-2021-26388, published 2022-05-11. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. Improper validation of the BIOS directory may allow for searches to read beyond the directory table copy in RAM, exposing out of bounds memory contents, resulting in a potential denial of service.
• CVE-2021-26378, published 2022-05-11. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. Insufficient bound checks in the System Management Unit (SMU) may result in access to an invalid address space that could result in denial of service.
• CVE-2021-26376, published 2022-05-11. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. Insufficient checks in System Management Unit (SMU) FeatureConfig may result in reenabling features potentially resulting in denial of resources and/or denial of service.
• CVE-2021-26373, published 2022-05-11. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. Insufficient bound checks in the System Management Unit (SMU) may result in a system voltage malfunction that could result in denial of resources and/or possibly denial of service.
• CVE-2021-26336, published 2021-11-16. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. Insufficient bounds checking in System Management Unit (SMU) may cause invalid memory accesses/updates that could result in SMU hang and subsequent failure to service any further requests from other…