Medium

DATE	CVE	VULNERABILITY TITLE	RISK
2023-05-09	CVE-2021-26354	Classic Buffer Overflow vulnerability in AMD products Insufficient bounds checking in ASP may allow an attacker to issue a system call from a compromised ABL which may cause arbitrary memory values to be initialized to zero, potentially leading to a loss of integrity. local low complexity amd CWE-120	5.5
2023-05-09	CVE-2021-26371	Unspecified vulnerability in AMD products A compromised or malicious ABL or UApp could send a SHA256 system call to the bootloader, which may result in exposure of ASP memory to userspace, potentially leading to information disclosure. local low complexity amd	5.5
2023-01-11	CVE-2021-26403	Unspecified vulnerability in AMD products Insufficient checks in SEV may lead to a malicious hypervisor disclosing the launch secret potentially resulting in compromise of VM confidentiality. local low complexity amd	6.5
2023-01-11	CVE-2023-20523	Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in AMD products TOCTOU in the ASP may allow a physical attacker to write beyond the buffer bounds, potentially leading to a loss of integrity or denial of service. high complexity amd CWE-367	5.7
2023-01-11	CVE-2023-20525	Improper Input Validation vulnerability in AMD products Insufficient syscall input validation in the ASP Bootloader may allow a privileged attacker to read memory outside the bounds of a mapped register potentially leading to a denial of service. network low complexity amd CWE-20	6.5
2023-01-11	CVE-2023-20527	Improper Input Validation vulnerability in AMD products Improper syscall input validation in the ASP Bootloader may allow a privileged attacker to read memory out-of-bounds, potentially leading to a denial-of-service. network low complexity amd CWE-20	6.5
2023-01-11	CVE-2023-20532	Improper Input Validation vulnerability in AMD products Insufficient input validation in the SMU may allow an attacker to improperly lock resources, potentially resulting in a denial of service. network low complexity amd CWE-20	5.3
2022-11-09	CVE-2022-23824	IBPB may not prevent return branch predictions from being specified by pre-IBPB branch targets leading to a potential information disclosure. local low complexity xen amd fedoraproject	5.5
2022-08-10	CVE-2021-46778	Information Exposure Through Discrepancy vulnerability in AMD products Execution unit scheduler contention may lead to a side channel vulnerability found on AMD CPU microarchitectures codenamed “Zen 1”, “Zen 2” and “Zen 3” that use simultaneous multithreading (SMT). local high complexity amd CWE-203	5.6
2022-07-14	CVE-2022-23825	Exposure of Resource to Wrong Sphere vulnerability in multiple products Aliases in the branch predictor may cause some AMD processors to predict the wrong branch type potentially leading to information disclosure. local low complexity debian fedoraproject amd vmware CWE-668	6.5