SB2024101744 - Multiple vulnerabilities in HPE ProLiant DL Servers with AMD EPYC processors
Published: October 17, 2024
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 9 secuirty vulnerabilities.
1) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2023-20578)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to improper handling of certain special address ranges with invalid device table entries (DTEs). A local user can induce DTE faults to bypass RMP checks in SEV-SNP.
2) Out-of-bounds write (CVE-ID: CVE-2021-26344)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary error when processing the AMD PSP1 Configuration Block (APCB). A local user can trigger an out-of-bounds write, modify the APCB block and execute arbitrary code on the target system.
3) Improper Initialization (CVE-ID: CVE-2023-20591)
The vulnerability allows a malicious guest to compromise the affected system.
The vulnerability exists due to improper initialization of IOMMU during the DRTM event. A malicious guest can read or modify hypervisor memory.
4) Input validation error (CVE-ID: CVE-2023-20584)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to insufficient validation of special address ranges with invalid device table entries (DTEs) in IOMMU. A local user can induce DTE faults to bypass RMP checks in SEV-SNP.
5) Stack-based buffer overflow (CVE-ID: CVE-2021-46746)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in ASP Secure OS Trusted Execution Environment (TEE). A local privileged user with access to AMD signing keys can trigger a stack-based buffer overflow and perform a denial of service (DoS) attack.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
6) Incomplete cleanup (CVE-ID: CVE-2023-31356)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to incomplete system memory cleanup in SEV firmware. A local privileged user can corrupt guest private memory.
7) Improper access control (CVE-ID: CVE-2021-26387)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to improper access restrictions in ASP kernel. A local privileged user with access to AMD signing keys and the BIOS menu or UEFI shell can map DRAM regions in protected areas.
8) Out-of-bounds write (CVE-ID: CVE-2021-46772)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient input validation in the ABL. A local privileged user with access to the BIOS menu or UEFI shell can tamper with the structure headers in SPI ROM and perform a denial of service (DoS) attack.
9) Incomplete cleanup (CVE-ID: CVE-2023-20518)
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to incomplete cleanup in the ASP. A local privileged user with access to the BIOS menu or UEFI shell can obtain the Master Encryption Key (MEK).
Remediation
Install update from vendor's website.