Lucene search

MitreCVE-2018-8931

HistoryMar 22, 2018 - 2:29 p.m.

CVE-2018-8931

2018-03-2214:29:00

CWE-732

mitre

web.nvd.nist.gov

amd

ryzen

ryzen pro

ryzen mobile

processor chips

access control

secure processor

ryzenfall-1

cve-2018-8931

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

AI Score

9.1

Confidence

High

EPSS

0.004

Percentile

72.8%

JSON

The AMD Ryzen, Ryzen Pro, and Ryzen Mobile processor chips have insufficient access control for the Secure Processor, aka RYZENFALL-1.

Affected configurations

Nvd

Node

amdryzen_mobile_firmwareMatch-

AND

amdryzen_mobileMatch-

Node

amdryzen_pro_firmwareMatch-

AND

amdryzen_proMatch-

Node

amdryzen_firmwareMatch-

AND

amdryzenMatch-

VendorProductVersionCPE
amdryzen_mobile_firmware-cpe:2.3:o:amd:ryzen_mobile_firmware:-:*:*:*:*:*:*:*
amdryzen_mobile-cpe:2.3:h:amd:ryzen_mobile:-:*:*:*:*:*:*:*
amdryzen_pro_firmware-cpe:2.3:o:amd:ryzen_pro_firmware:-:*:*:*:*:*:*:*
amdryzen_pro-cpe:2.3:h:amd:ryzen_pro:-:*:*:*:*:*:*:*
amdryzen_firmware-cpe:2.3:o:amd:ryzen_firmware:-:*:*:*:*:*:*:*
amdryzen-cpe:2.3:h:amd:ryzen:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
amd	ryzen_mobile_firmware	-	cpe:2.3:o:amd:ryzen_mobile_firmware:-:::::::*
amd	ryzen_mobile	-	cpe:2.3:h:amd:ryzen_mobile:-:::::::*
amd	ryzen_pro_firmware	-	cpe:2.3:o:amd:ryzen_pro_firmware:-:::::::*
amd	ryzen_pro	-	cpe:2.3:h:amd:ryzen_pro:-:::::::*
amd	ryzen_firmware	-	cpe:2.3:o:amd:ryzen_firmware:-:::::::*
amd	ryzen	-	cpe:2.3:h:amd:ryzen:-:::::::*

References

amdflaws.com/

blog.trailofbits.com/2018/03/15/amd-flaws-technical-summary/

community.amd.com/community/amd-corporate/blog/2018/03/21/initial-amd-technical-assessment-of-cts-labs-research

safefirmware.com/amdflaws_whitepaper.pdf

Social References

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

AI Score

9.1

Confidence

High

EPSS

0.004

Percentile

72.8%

JSON

Related for CVE-2018-8931