Vulnerabilities > AMD > Epyc 7402 Firmware
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2022-05-10 | CVE-2021-26370 | Improper Input Validation vulnerability in AMD products Improper validation of destination address in SVC_LOAD_FW_IMAGE_BY_INSTANCE and SVC_LOAD_BINARY_BY_ATTRIB in a malicious UApp or ABL may allow an attacker to overwrite arbitrary bootloader memory with SPI ROM contents resulting in a loss of integrity and availability. | 7.1 |
| 2022-05-10 | CVE-2021-26408 | Unspecified vulnerability in AMD products Insufficient validation of elliptic curve points in SEV-legacy firmware may compromise SEV-legacy guest migration potentially resulting in loss of guest's integrity or confidentiality. | 7.1 |
| 2022-03-11 | CVE-2021-26341 | Improper Cross-boundary Removal of Sensitive Data vulnerability in AMD products Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage. | 6.5 |
| 2022-03-11 | CVE-2021-26401 | Unspecified vulnerability in AMD products LFENCE/JMP (mitigation V2-2) may not sufficiently mitigate CVE-2017-5715 on some AMD CPUs. | 5.6 |
| 2022-02-04 | CVE-2020-12966 | Information Exposure vulnerability in AMD products AMD EPYC™ Processors contain an information disclosure vulnerability in the Secure Encrypted Virtualization with Encrypted State (SEV-ES) and Secure Encrypted Virtualization with Secure Nested Paging (SEV-SNP). | 5.5 |
| 2021-12-10 | CVE-2021-26340 | Unspecified vulnerability in AMD products A malicious hypervisor in conjunction with an unprivileged attacker process inside an SEV/SEV-ES guest VM may fail to flush the Translation Lookaside Buffer (TLB) resulting in unexpected behavior inside the virtual machine (VM). | 8.4 |
| 2021-11-16 | CVE-2020-12944 | Improper Input Validation vulnerability in AMD products Insufficient validation of BIOS image length by ASP Firmware could lead to arbitrary code execution. | 7.8 |
| 2021-11-16 | CVE-2020-12946 | Improper Input Validation vulnerability in AMD products Insufficient input validation in ASP firmware for discrete TPM commands could allow a potential loss of integrity and denial of service. | 7.1 |
| 2021-11-16 | CVE-2020-12951 | Race Condition vulnerability in AMD products Race condition in ASP firmware could allow less privileged x86 code to perform ASP SMM (System Management Mode) operations. | 7.0 |
| 2021-11-16 | CVE-2020-12954 | Unspecified vulnerability in AMD products A side effect of an integrated chipset option may be able to be used by an attacker to bypass SPI ROM protections, allowing unauthorized SPI ROM modification. | 5.5 |