#VU75981 Memory leak in AMD products - CVE-2021-26371
Vulnerability identifier: #VU75981
Vulnerability risk: Low
CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2021-26371
CWE-ID:
CWE-401
Exploitation vector: Local
Exploit availability: No
Vulnerable software:
1st Gen AMD EPYC Processors
Hardware solutions /
Firmware
2nd Gen AMD EPYC Processors
Hardware solutions /
Firmware
3rd Gen AMD EPYC Processors
Hardware solutions /
Firmware
Vendor: AMD
Description
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due memory leak. A compromised or malicious ABL or UApp can send a SHA256 system call to the bootloader and expose ASP memory to userspace.
Mitigation
Install updates from vendor's website.
Vulnerable software versions
1st Gen AMD EPYC Processors: before NaplesPI 1.0.0.H
2nd Gen AMD EPYC Processors: before RomePI 1.0.0.D
3rd Gen AMD EPYC Processors: before MilanPI 1.0.0.6
External links
https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3001.html
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
