Epyc 7643 Firmware

DATE	CVE	VULNERABILITY TITLE	RISK
2023-05-09	CVE-2021-46769	Improper Input Validation vulnerability in AMD products Insufficient syscall input validation in the ASP Bootloader may allow a privileged attacker to execute arbitrary DMA copies, which can lead to code execution. network low complexity amd CWE-20	8.8
2023-05-09	CVE-2021-46775	Improper Input Validation vulnerability in AMD products Improper input validation in ABL may enable an attacker with physical access, to perform arbitrary memory overwrites, potentially leading to a loss of integrity and code execution. low complexity amd CWE-20	6.8
2023-05-09	CVE-2022-23818	Improper Input Validation vulnerability in AMD products Insufficient input validation on the model specific register: VM_HSAVE_PA may potentially lead to loss of SEV-SNP guest memory integrity. network low complexity amd CWE-20	7.5
2023-05-09	CVE-2023-20520	Out-of-bounds Write vulnerability in AMD products Improper access control settings in ASP Bootloader may allow an attacker to corrupt the return address causing a stack-based buffer overrun potentially leading to arbitrary code execution. network low complexity amd CWE-787 critical	9.8
2023-05-09	CVE-2023-20524	Out-of-bounds Write vulnerability in AMD products An attacker with a compromised ASP could possibly send malformed commands to an ASP on another CPU, resulting in an out of bounds write, potentially leading to a loss a loss of integrity. network low complexity amd CWE-787	7.5
2023-01-11	CVE-2021-26316	Improper Input Validation vulnerability in AMD products Failure to validate the communication buffer and communication service in the BIOS may allow an attacker to tamper with the buffer resulting in potential SMM (System Management Mode) arbitrary code execution. local low complexity amd CWE-20	7.8
2023-01-11	CVE-2021-26328	Unspecified vulnerability in AMD products Failure to verify the mode of CPU execution at the time of SNP_INIT may lead to a potential loss of memory integrity for SNP guests. local low complexity amd	4.4
2023-01-11	CVE-2021-26343	Exposure of Resource to Wrong Sphere vulnerability in AMD products Insufficient validation in ASP BIOS and DRTM commands may allow malicious supervisor x86 software to disclose the contents of sensitive memory which may result in information disclosure. local low complexity amd CWE-668	5.5
2023-01-11	CVE-2021-26355	Unspecified vulnerability in AMD products Insufficient fencing and checks in System Management Unit (SMU) may result in access to invalid message port registers that could result in a potential denial-of-service. local low complexity amd	5.5
2023-01-11	CVE-2021-26396	Insufficient Verification of Data Authenticity vulnerability in AMD products Insufficient validation of address mapping to IO in ASP (AMD Secure Processor) may result in a loss of memory integrity in the SNP guest. local low complexity amd CWE-345	4.4