Advisories · Technology

3rd Gen AMD EPYC™.

Every CVE that names 3rd Gen AMD EPYC™ among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2023-20524 CVE record

CVSS 7.5 High

Out-of-bounds write in 2nd Gen AMD EPYC™ and others
- 2nd Gen AMD EPYC™
- 3rd Gen AMD EPYC™
- Memory corruption
Not analysed yet 9 May 2023
CVE-2023-20520 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Out-of-bounds write in 1st Gen AMD EPYC™ and others
- 1st Gen AMD EPYC™
- 2nd Gen AMD EPYC™
- Memory corruption
Not analysed yet 9 May 2023
CVE-2022-23818 CVE record

CVSS 7.5 High

Insufficient input validation on the model specific register: VM_HSAVE_PA may potentially lead to loss of SEV-SNP guest memory integrity.
- 3rd Gen AMD EPYC™
Not analysed yet 9 May 2023
CVE-2021-46775 CVE record

CVSS 6.8 Medium

Improper input validation in ABL may enable an attacker with physical access, to perform arbitrary memory overwrites, potentially leading to a loss of integrity and code execution.
- 2nd Gen AMD EPYC™
- 3rd Gen AMD EPYC™
Not analysed yet 9 May 2023
CVE-2021-46769 CVE record

CVSS 8.8 High

Insufficient syscall input validation in the ASP Bootloader may allow a privileged attacker to execute arbitrary DMA copies, which can lead to code execution.
- 2nd Gen AMD EPYC™
- 3rd Gen AMD EPYC™
Not analysed yet 9 May 2023
CVE-2021-46764 CVE record

CVSS 7.5 High

Out-of-bounds write in 2nd Gen AMD EPYC™ and others
- 2nd Gen AMD EPYC™
- 3rd Gen AMD EPYC™
- Memory corruption
Not analysed yet 9 May 2023
CVE-2021-46763 CVE record

CVSS 7.5 High

Out-of-bounds write in 2nd Gen AMD EPYC™ and others
- 2nd Gen AMD EPYC™
- 3rd Gen AMD EPYC™
- Memory corruption
Not analysed yet 9 May 2023
CVE-2021-46762 CVE record

CVSS 3.9 Low

Insufficient input validation in the SMU may allow an attacker to corrupt SMU SRAM potentially leading to a loss of integrity or denial of service.
- 2nd Gen AMD EPYC™
- 3rd Gen AMD EPYC™
Not analysed yet 9 May 2023
CVE-2021-26397 CVE record

CVSS 7.1 High

Insufficient address validation, may allow an attacker with a compromised ABL and UApp to corrupt sensitive memory locations potentially resulting in a loss of integrity or availability.
- 3rd Gen AMD EPYC™
Not analysed yet 9 May 2023
CVE-2021-26379 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Insufficient input validation of mailbox data in the SMU may allow an attacker to coerce the SMU to corrupt SMRAM, potentially leading to a loss of integrity and privilege escalation.
- 2nd Gen AMD EPYC™
- 3rd Gen AMD EPYC™
Not analysed yet 9 May 2023
CVE-2021-46771 CVE record

Improper input validation in 3rd Gen AMD EPYC™
- 3rd Gen AMD EPYC™
- CWE-20
Not analysed yet 10 May 2022
CVE-2021-26324 CVE record

A bug with the SEV-ES TMR may lead to a potential loss of memory integrity for SNP-active VMs.
- 3rd Gen AMD EPYC™
Not analysed yet 10 May 2022
CVE-2021-26332 CVE record

Failure to verify SEV-ES TMR is not in MMIO space, SEV-ES FW could result in a potential loss of integrity or availability.
- 3rd Gen AMD EPYC™
Not analysed yet 10 May 2022
CVE-2021-26370 CVE record

Improper input validation in 2nd Gen AMD EPYC™ and others
- 2nd Gen AMD EPYC™
- 3rd Gen AMD EPYC™
- CWE-20
Not analysed yet 10 May 2022
CVE-2021-26325 CVE record

Improper input validation in 3rd Gen AMD EPYC™
- 3rd Gen AMD EPYC™
- CWE-20
Not analysed yet 16 Nov 2021
CVE-2021-26330 CVE record

Heap-based buffer overflow in 1st Gen AMD EPYC™ and others
- 1st Gen AMD EPYC™
- 2nd Gen AMD EPYC™
- Memory corruption
Not analysed yet 16 Nov 2021
CVE-2021-26327 CVE record

Improper input validation in 3rd Gen AMD EPYC™
- 3rd Gen AMD EPYC™
- CWE-20
Not analysed yet 16 Nov 2021
CVE-2021-26323 CVE record

Improper input validation in 3rd Gen AMD EPYC™
- 3rd Gen AMD EPYC™
- CWE-20
Not analysed yet 16 Nov 2021
CVE-2020-12961 CVE record

Improper input validation in 2nd Gen AMD EPYC™ and others
- 2nd Gen AMD EPYC™
- 3rd Gen AMD EPYC™
- CWE-20
Not analysed yet 16 Nov 2021
CVE-2021-26315 CVE record

Insufficient verification of data authenticity in 3rd Gen AMD EPYC™
- 3rd Gen AMD EPYC™
- CWE-345
Not analysed yet 16 Nov 2021
CVE-2020-12954 CVE record

Protection mechanism failure in 1st Gen AMD EPYC™ and others
- 1st Gen AMD EPYC™
- 2nd Gen AMD EPYC™
- CWE-693
Not analysed yet 16 Nov 2021
CVE-2021-26331 CVE record

Improper input validation in 1st Gen AMD EPYC™ and others
- 1st Gen AMD EPYC™
- 2nd Gen AMD EPYC™
- CWE-20
Not analysed yet 16 Nov 2021
CVE-2021-26321 CVE record

Improper input validation in 1st Gen AMD EPYC™ and others
- 1st Gen AMD EPYC™
- 2nd Gen AMD EPYC™
- CWE-20
Not analysed yet 16 Nov 2021
CVE-2021-26320 CVE record

Improper certificate validation in 1st Gen AMD EPYC™ and others
- 1st Gen AMD EPYC™
- 2nd Gen AMD EPYC™
- Weak cryptography or TLS
Not analysed yet 16 Nov 2021
CVE-2021-26322 CVE record

Persistent platform private key may not be protected with a random IV leading to a potential “two time pad attack”.
- 1st Gen AMD EPYC™
- 2nd Gen AMD EPYC™
- CWE-320
Not analysed yet 16 Nov 2021
CVE-2021-26329 CVE record

AMD System Management Unit (SMU) may experience an integer overflow when an invalid length is provided which may result in a potential loss of resources.
- 1st Gen AMD EPYC™
- 2nd Gen AMD EPYC™
- CWE-130
Not analysed yet 16 Nov 2021
CVE-2021-26338 CVE record

Improper access control in 2nd Gen AMD EPYC™ and others
- 2nd Gen AMD EPYC™
- 3rd Gen AMD EPYC™
- Broken access control
Not analysed yet 16 Nov 2021
CVE-2021-26326 CVE record

Failure to validate VM_HSAVE_PA during SNP_INIT may result in a loss of memory integrity.
- 3rd Gen AMD EPYC™
- CWE-665
Not analysed yet 16 Nov 2021