Vulnerabilities > AMD > High
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2022-05-12 | CVE-2021-26386 | Out-of-bounds Write vulnerability in AMD products A malicious or compromised UApp or ABL may be used by an attacker to issue a malformed system call to the Stage 2 Bootloader potentially leading to corrupt memory and code execution. | 7.8 |
| 2022-05-12 | CVE-2021-26362 | Unspecified vulnerability in AMD products A malicious or compromised UApp or ABL may be used by an attacker to issue a malformed system call which results in mapping sensitive System Management Network (SMN) registers leading to a loss of integrity and availability. | 7.1 |
| 2022-05-12 | CVE-2021-26366 | Unspecified vulnerability in AMD products An attacker, who gained elevated privileges via some other vulnerability, may be able to read data from Boot ROM resulting in a loss of system integrity. | 7.1 |
| 2022-05-12 | CVE-2021-26369 | Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in AMD products A malicious or compromised UApp or ABL may be used by an attacker to send a malformed system call to the bootloader, resulting in out-of-bounds memory accesses. | 7.8 |
| 2022-05-10 | CVE-2021-26324 | Unspecified vulnerability in AMD products A bug with the SEV-ES TMR may lead to a potential loss of memory integrity for SNP-active VMs. | 7.8 |
| 2022-05-10 | CVE-2021-26332 | Unspecified vulnerability in AMD products Failure to verify SEV-ES TMR is not in MMIO space, SEV-ES FW could result in a potential loss of integrity or availability. | 7.1 |
| 2022-05-10 | CVE-2021-26353 | Improper Initialization vulnerability in AMD products Failure to validate inputs in SMM may allow an attacker to create a mishandled error leaving the DRTM UApp in a partially initialized state potentially resulting in loss of memory integrity. | 7.8 |
| 2022-05-10 | CVE-2021-26370 | Improper Input Validation vulnerability in AMD products Improper validation of destination address in SVC_LOAD_FW_IMAGE_BY_INSTANCE and SVC_LOAD_BINARY_BY_ATTRIB in a malicious UApp or ABL may allow an attacker to overwrite arbitrary bootloader memory with SPI ROM contents resulting in a loss of integrity and availability. | 7.1 |
| 2022-05-10 | CVE-2021-26408 | Unspecified vulnerability in AMD products Insufficient validation of elliptic curve points in SEV-legacy firmware may compromise SEV-legacy guest migration potentially resulting in loss of guest's integrity or confidentiality. | 7.1 |
| 2022-05-10 | CVE-2021-46771 | Unspecified vulnerability in AMD products Insufficient validation of addresses in AMD Secure Processor (ASP) firmware system call may potentially lead to arbitrary code execution by a compromised user application. | 7.8 |