SB2023110670 - Multiple vulnerabilities in Certain HPE ProLiant DL/DX/XL Server Using Certain AMD EPYC Processors, AMD-SB-3002, AMD Server

Description

This security bulletin contains information about 10 secuirty vulnerabilities.

1) Buffer overflow (CVE-ID: CVE-2022-23820)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to improper validation of the AMD SMM communication buffer. A local user can corrupt the SMRAM and execute arbitrary code on the system.

2) Out-of-bounds write (CVE-ID: CVE-2021-46774)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error when processing DRAM address in System Management Unit (SMU). A local user can trigger an out-of-bounds write and perform a denial of service (DoS) attack.

3) Out-of-bounds write (CVE-ID: CVE-2023-20533)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error when processing DRAM address in System Management Unit (SMU). A local user can trigger an out-of-bounds write and perform a denial of service (DoS) attack.

4) Use-after-free (CVE-ID: CVE-2023-20519)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error in the management of an SNP guest context page. A malicious hypervisor can masquerade as the guest's migration agent and perform a denial of service (DoS) attack.

5) Input validation error (CVE-ID: CVE-2023-20566)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to insufficient validation of user-supplied input n ASP with SNP enabled. A local user can compromise guest memory integrity.

6) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2023-20521)

The vulnerability allows an attacker to perform a denial of service attack.

The vulnerability exists due to a race condition in ASP Bootloader. An attacker with physical access to device can tamper with SPI ROM records after memory content verification and gain access to sensitive information of perform a denial of service (DoS) attack.

7) Incomplete cleanup (CVE-ID: CVE-2021-46766)

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to incomplete clearing of sensitive data in the ASP Bootloader. A local user with access to ASP SRAM can gain access to sensitive information.

8) Configuration (CVE-ID: CVE-2022-23830)

The issue may allow a local user to bypass implemented security restrictions.

The issue exists due to immutable SMM configuration when SNP is enabled. A local user can modify guest memory.

9) Input validation error (CVE-ID: CVE-2023-20526)

The vulnerability allows an attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied input in the ASP Bootloader. An attacker with physical access to device can read contents of ASP memory.

10) Out-of-bounds read (CVE-ID: CVE-2021-26345)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary condition in APCB. A local user can trigger an out-of-bounds read error and perform a denial of service (DoS) attack.

Remediation

Install update from vendor's website.

References

• https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbhf04550en_us