Lucene search

MitreCVE-2018-8935

HistoryMar 22, 2018 - 2:29 p.m.

CVE-2018-8935

2018-03-2214:29:00

mitre

web.nvd.nist.gov

amd

ryzen

promontory

chipset

backdoor

vulnerability

cve-2018-8935

chimera-hw

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

0.004

Percentile

72.4%

JSON

The Promontory chipset, as used in AMD Ryzen and Ryzen Pro platforms, has a backdoor in the ASIC, aka CHIMERA-HW.

Affected configurations

Nvd

Node

amdryzen_pro_firmwareMatch-

AND

amdryzen_proMatch-

Node

amdryzen_firmwareMatch-

AND

amdryzenMatch-

VendorProductVersionCPE
amdryzen_pro_firmware-cpe:2.3:o:amd:ryzen_pro_firmware:-:*:*:*:*:*:*:*
amdryzen_pro-cpe:2.3:h:amd:ryzen_pro:-:*:*:*:*:*:*:*
amdryzen_firmware-cpe:2.3:o:amd:ryzen_firmware:-:*:*:*:*:*:*:*
amdryzen-cpe:2.3:h:amd:ryzen:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
amd	ryzen_pro_firmware	-	cpe:2.3:o:amd:ryzen_pro_firmware:-:::::::*
amd	ryzen_pro	-	cpe:2.3:h:amd:ryzen_pro:-:::::::*
amd	ryzen_firmware	-	cpe:2.3:o:amd:ryzen_firmware:-:::::::*
amd	ryzen	-	cpe:2.3:h:amd:ryzen:-:::::::*

References

amdflaws.com/

blog.trailofbits.com/2018/03/15/amd-flaws-technical-summary/

community.amd.com/community/amd-corporate/blog/2018/03/21/initial-amd-technical-assessment-of-cts-labs-research

safefirmware.com/amdflaws_whitepaper.pdf

Social References

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

0.004

Percentile

72.4%

JSON

Related for CVE-2018-8935