SB2024100225 - Multiple vulnerabilities in AMD EPYC processors

Description

This security bulletin contains information about 7 secuirty vulnerabilities.

1) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2023-20578)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to improper handling of certain special address ranges with invalid device table entries (DTEs). A local user can induce DTE faults to bypass RMP checks in SEV-SNP.

2) Out-of-bounds write (CVE-ID: CVE-2021-26344)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error when processing the AMD PSP1 Configuration Block (APCB). A local user can trigger an out-of-bounds write, modify the APCB block and execute arbitrary code on the target system.

3) Improper Initialization (CVE-ID: CVE-2023-20591)

The vulnerability allows a malicious guest to compromise the affected system.

The vulnerability exists due to improper initialization of IOMMU during the DRTM event. A malicious guest can read or modify hypervisor memory.

4) Input validation error (CVE-ID: CVE-2023-20584)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to insufficient validation of special address ranges with invalid device table entries (DTEs) in IOMMU. A local user can induce DTE faults to bypass RMP checks in SEV-SNP.

5) Incomplete cleanup (CVE-ID: CVE-2023-31356)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to incomplete system memory cleanup in SEV firmware. A local privileged user can corrupt guest private memory.

6) Out-of-bounds write (CVE-ID: CVE-2021-46772)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation in the ABL. A local privileged user with access to the BIOS menu or UEFI shell can tamper with the structure headers in SPI ROM and perform a denial of service (DoS) attack.

7) Incomplete cleanup (CVE-ID: CVE-2023-20518)

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to incomplete cleanup in the ASP. A local privileged user with access to the BIOS menu or UEFI shell can obtain the Master Encryption Key (MEK).

Remediation

Install update from vendor's website.

References

• https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3003.html