AMD 3rd Gen AMD EPYC™
At a glance
- Source
- NVD
- EPSS
- EPSS 0.17 % · percentile 6 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- AMD
- NVD status
- Modified
Description
When the AMD Platform Security Processor (PSP) boot rom loads, authenticates, and subsequently decrypts an encrypted FW, due to insufficient verification of the integrity of decrypted image, arbitrary code may be executed in the PSP when encrypted firmware images are used.
Weaknesses (CWE)
- CWE-345 — Insufficient Verification of Data Authenticity
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 4.6 | AV:L/AC:L/Au:N/C:P/I:P/A:P | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2021-13121
- GCVE · GCVE-0-2021-26315
Affected configurations (NVD CPE)
cpe:2.3:o:amd:epyc_7003_firmware:*:*:*:*:*:*:*:*< milanpi-sp3_1.0.0.4cpe:2.3:o:amd:epyc_72f3_firmware:*:*:*:*:*:*:*:*< milanpi-sp3_1.0.0.4cpe:2.3:o:amd:epyc_7313_firmware:*:*:*:*:*:*:*:*< milanpi-sp3_1.0.0.4cpe:2.3:o:amd:epyc_7313p_firmware:*:*:*:*:*:*:*:*< milanpi-sp3_1.0.0.4cpe:2.3:o:amd:epyc_7343_firmware:*:*:*:*:*:*:*:*< milanpi-sp3_1.0.0.4cpe:2.3:o:amd:epyc_73f3_firmware:*:*:*:*:*:*:*:*< milanpi-sp3_1.0.0.4cpe:2.3:o:amd:epyc_7413_firmware:*:*:*:*:*:*:*:*< milanpi-sp3_1.0.0.4cpe:2.3:o:amd:epyc_7443_firmware:*:*:*:*:*:*:*:*< milanpi-sp3_1.0.0.4cpe:2.3:o:amd:epyc_7443p_firmware:*:*:*:*:*:*:*:*< milanpi-sp3_1.0.0.4cpe:2.3:o:amd:epyc_7453_firmware:*:*:*:*:*:*:*:*< milanpi-sp3_1.0.0.4cpe:2.3:o:amd:epyc_74f3_firmware:*:*:*:*:*:*:*:*< milanpi-sp3_1.0.0.4cpe:2.3:o:amd:epyc_7513_firmware:*:*:*:*:*:*:*:*< milanpi-sp3_1.0.0.4cpe:2.3:o:amd:epyc_7543_firmware:*:*:*:*:*:*:*:*< milanpi-sp3_1.0.0.4cpe:2.3:o:amd:epyc_7543p_firmware:*:*:*:*:*:*:*:*< milanpi-sp3_1.0.0.4cpe:2.3:o:amd:epyc_75f3_firmware:*:*:*:*:*:*:*:*< milanpi-sp3_1.0.0.4cpe:2.3:o:amd:epyc_7643_firmware:*:*:*:*:*:*:*:*< milanpi-sp3_1.0.0.4cpe:2.3:o:amd:epyc_7663_firmware:*:*:*:*:*:*:*:*< milanpi-sp3_1.0.0.4cpe:2.3:o:amd:epyc_7713_firmware:*:*:*:*:*:*:*:*< milanpi-sp3_1.0.0.4cpe:2.3:o:amd:epyc_7713p_firmware:*:*:*:*:*:*:*:*< milanpi-sp3_1.0.0.4cpe:2.3:o:amd:epyc_7763_firmware:*:*:*:*:*:*:*:*< milanpi-sp3_1.0.0.4
Affected products
| Product | Versions |
|---|---|
| AMD · 3rd Gen AMD EPYC™ | affected unspecified < MilanPI-SP3_1.0.0.4 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |