Medium

DATE	CVE	VULNERABILITY TITLE	RISK
2023-11-14	CVE-2021-46758	Unspecified vulnerability in AMD products Insufficient validation of SPI flash addresses in the ASP (AMD Secure Processor) bootloader may allow an attacker to read data in memory mapped beyond SPI flash resulting in a potential loss of availability and integrity. low complexity amd	6.1
2023-09-20	CVE-2023-20594	Improper Initialization vulnerability in AMD products Improper initialization of variables in the DXE driver may allow a privileged user to leak sensitive information via local access. local low complexity amd CWE-665	4.4
2023-09-20	CVE-2023-20597	Improper Initialization vulnerability in AMD products Improper initialization of variables in the DXE driver may allow a privileged user to leak sensitive information via local access. local low complexity amd CWE-665	5.5
2023-08-08	CVE-2023-20569	Information Exposure Through Discrepancy vulnerability in multiple products A side channel vulnerability on some of the AMD CPUs may allow an attacker to influence the return address prediction. local high complexity fedoraproject debian amd microsoft CWE-203	4.7
2023-08-08	CVE-2023-20589	Unspecified vulnerability in AMD products An attacker with specialized hardware and physical access to an impacted device may be able to perform a voltage fault injection attack resulting in compromise of the ASP secure boot potentially leading to arbitrary code execution. low complexity amd	6.8
2023-05-09	CVE-2021-26354	Classic Buffer Overflow vulnerability in AMD products Insufficient bounds checking in ASP may allow an attacker to issue a system call from a compromised ABL which may cause arbitrary memory values to be initialized to zero, potentially leading to a loss of integrity. local low complexity amd CWE-120	5.5
2023-03-01	CVE-2022-27672	Unspecified vulnerability in AMD products When SMT is enabled, certain AMD processors may speculatively execute instructions using a target from the sibling thread after an SMT mode switch potentially resulting in information disclosure. local high complexity amd	4.7
2023-01-11	CVE-2021-26346	Integer Overflow or Wraparound vulnerability in AMD products Failure to validate the integer operand in ASP (AMD Secure Processor) bootloader may allow an attacker to introduce an integer overflow in the L2 directory table in SPI flash resulting in a potential denial of service. local low complexity amd CWE-190	5.5
2022-11-09	CVE-2021-26393	Memory Leak vulnerability in AMD products Insufficient memory cleanup in the AMD Secure Processor (ASP) Trusted Execution Environment (TEE) may allow an authenticated attacker with privileges to generate a valid signed TA and potentially poison the contents of the process memory with attacker controlled data resulting in a loss of confidentiality. local low complexity amd CWE-401	5.5
2022-11-09	CVE-2022-23824	IBPB may not prevent return branch predictions from being specified by pre-IBPB branch targets leading to a potential information disclosure. local low complexity xen amd fedoraproject	5.5