High

DATE	CVE	VULNERABILITY TITLE	RISK
2023-01-11	CVE-2021-26402	Out-of-bounds Write vulnerability in AMD products Insufficient bounds checking in ASP (AMD Secure Processor) firmware while handling BIOS mailbox commands, may allow an attacker to write partially-controlled data out-of-bounds to SMM or SEV-ES regions which may lead to a potential loss of integrity and availability. local low complexity amd CWE-787	7.1
2023-01-11	CVE-2023-20529	Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in AMD products Insufficient bound checks in the SMU may allow an attacker to update the from/to address space to an invalid value potentially resulting in a denial of service. network low complexity amd CWE-119	7.5
2023-01-11	CVE-2023-20531	Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in AMD products Insufficient bound checks in the SMU may allow an attacker to update the SRAM from/to address space to an invalid value potentially resulting in a denial of service. network low complexity amd CWE-119	7.5
2022-05-10	CVE-2021-26370	Improper Input Validation vulnerability in AMD products Improper validation of destination address in SVC_LOAD_FW_IMAGE_BY_INSTANCE and SVC_LOAD_BINARY_BY_ATTRIB in a malicious UApp or ABL may allow an attacker to overwrite arbitrary bootloader memory with SPI ROM contents resulting in a loss of integrity and availability. local low complexity amd CWE-20	7.1
2021-12-10	CVE-2021-26340	Unspecified vulnerability in AMD products A malicious hypervisor in conjunction with an unprivileged attacker process inside an SEV/SEV-ES guest VM may fail to flush the Translation Lookaside Buffer (TLB) resulting in unexpected behavior inside the virtual machine (VM). local low complexity amd	8.4
2021-11-16	CVE-2020-12944	Improper Input Validation vulnerability in AMD products Insufficient validation of BIOS image length by ASP Firmware could lead to arbitrary code execution. local low complexity amd CWE-20	7.8
2021-11-16	CVE-2020-12946	Improper Input Validation vulnerability in AMD products Insufficient input validation in ASP firmware for discrete TPM commands could allow a potential loss of integrity and denial of service. local low complexity amd CWE-20	7.1
2021-11-16	CVE-2021-26322	Use of Insufficiently Random Values vulnerability in AMD products Persistent platform private key may not be protected with a random IV leading to a potential “two time pad attack”. network low complexity amd CWE-330	7.5
2021-11-16	CVE-2021-26338	Unspecified vulnerability in AMD products Improper access controls in System Management Unit (SMU) may allow for an attacker to override performance control tables located in DRAM resulting in a potential lack of system resources. network low complexity amd	7.5
2021-06-11	CVE-2020-12988	Unspecified vulnerability in AMD products A potential denial of service (DoS) vulnerability exists in the integrated chipset that may allow a malicious attacker to hang the system when it is rebooted. network low complexity amd	7.5