Lucene search

AMDCVE-2021-26408

HistoryMay 10, 2022 - 7:15 p.m.

CVE-2021-26408

2022-05-1019:15:08

AMD

web.nvd.nist.gov

cve-2021-26408

insufficient validation

elliptic curve points

sev-legacy

firmware

guest migration

integrity

confidentiality

nvd

CVSS2

6.6

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:C/I:C/A:N

CVSS3

7.1

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

AI Score

7.1

Confidence

High

EPSS

Percentile

12.6%

JSON

Insufficient validation of elliptic curve points in SEV-legacy firmware may compromise SEV-legacy guest migration potentially resulting in loss of guest’s integrity or confidentiality.

Affected configurations

Nvd

Node

amdepyc_7002_firmwareRange<romepi-sp3_1.0.0.c

AND

amdepyc_7002Match-

Node

amdepyc_7001_firmwareRange<naplespi-sp3_1.0.0.g

AND

amdepyc_7001Match-

Node

amdepyc_7232p_firmwareRange<romepi-sp3_1.0.0.c

AND

amdepyc_7232pMatch-

Node

amdepyc_7252_firmwareRange<romepi-sp3_1.0.0.c

AND

amdepyc_7252Match-

Node

amdepyc_7262_firmwareRange<romepi-sp3_1.0.0.c

AND

amdepyc_7262Match-

Node

amdepyc_7272_firmwareRange<romepi-sp3_1.0.0.c

AND

amdepyc_7272Match-

Node

amdepyc_7282_firmwareRange<romepi-sp3_1.0.0.c

AND

amdepyc_7282Match-

Node

amdepyc_7302_firmwareRange<romepi-sp3_1.0.0.c

AND

amdepyc_7302Match-

Node

amdepyc_7302p_firmwareRange<romepi-sp3_1.0.0.c

AND

amdepyc_7302pMatch-

Node

amdepyc_7352_firmwareRange<romepi-sp3_1.0.0.c

AND

amdepyc_7352Match-

Node

amdepyc_7402_firmwareRange<romepi-sp3_1.0.0.c

AND

amdepyc_7402Match-

Node

amdepyc_7402p_firmwareRange<romepi-sp3_1.0.0.c

AND

amdepyc_7402pMatch-

Node

amdepyc_7452_firmwareRange<romepi-sp3_1.0.0.c

AND

amdepyc_7452Match-

Node

amdepyc_7502_firmwareRange<romepi-sp3_1.0.0.c

AND

amdepyc_7502Match-

Node

amdepyc_7502p_firmwareRange<romepi-sp3_1.0.0.c

AND

amdepyc_7502pMatch-

Node

amdepyc_7532_firmwareRange<romepi-sp3_1.0.0.c

AND

amdepyc_7532Match-

Node

amdepyc_7542_firmwareRange<romepi-sp3_1.0.0.c

AND

amdepyc_7542Match-

Node

amdepyc_7552_firmwareRange<romepi-sp3_1.0.0.c

AND

amdepyc_7552Match-

Node

amdepyc_7642_firmwareRange<romepi-sp3_1.0.0.c

AND

amdepyc_7642Match-

Node

amdepyc_7662_firmwareRange<romepi-sp3_1.0.0.c

AND

amdepyc_7662Match-

Node

amdepyc_7702_firmwareRange<romepi-sp3_1.0.0.c

AND

amdepyc_7702Match-

Node

amdepyc_7702p_firmwareRange<romepi-sp3_1.0.0.c

AND

amdepyc_7702pMatch-

Node

amdepyc_7742_firmwareRange<romepi-sp3_1.0.0.c

AND

amdepyc_7742Match-

Node

amdepyc_7f32_firmwareRange<romepi-sp3_1.0.0.c

AND

amdepyc_7f32Match-

Node

amdepyc_7f52_firmwareRange<romepi-sp3_1.0.0.c

AND

amdepyc_7f52Match-

Node

amdepyc_7f72_firmwareRange<romepi-sp3_1.0.0.c

AND

amdepyc_7f72Match-

Node

amdepyc_7251_firmwareRange<naplespi-sp3_1.0.0.g

AND

amdepyc_7251Match-

Node

amdepyc_7281_firmwareRange<naplespi-sp3_1.0.0.g

AND

amdepyc_7281Match-

Node

amdepyc_7301_firmwareRange<naplespi-sp3_1.0.0.g

AND

amdepyc_7301Match-

Node

amdepyc_7351_firmwareRange<naplespi-sp3_1.0.0.g

AND

amdepyc_7351Match-

Node

amdepyc_7351p_firmwareRange<naplespi-sp3_1.0.0.g

AND

amdepyc_7351pMatch-

Node

amdepyc_7401_firmwareRange<naplespi-sp3_1.0.0.g

AND

amdepyc_7401Match-

Node

amdepyc_7401p_firmwareRange<naplespi-sp3_1.0.0.g

AND

amdepyc_7401pMatch-

Node

amdepyc_7451_firmwareRange<naplespi-sp3_1.0.0.g

AND

amdepyc_7451Match-

Node

amdepyc_7501_firmwareRange<naplespi-sp3_1.0.0.g

AND

amdepyc_7501Match-

Node

amdepyc_7551_firmwareRange<naplespi-sp3_1.0.0.g

AND

amdepyc_7551Match-

Node

amdepyc_7551p_firmwareRange<naplespi-sp3_1.0.0.g

AND

amdepyc_7551pMatch-

Node

amdepyc_7601_firmwareRange<naplespi-sp3_1.0.0.g

AND

amdepyc_7601Match-

VendorProductVersionCPE
amdepyc_7002_firmware*cpe:2.3:o:amd:epyc_7002_firmware:*:*:*:*:*:*:*:*
amdepyc_7002-cpe:2.3:h:amd:epyc_7002:-:*:*:*:*:*:*:*
amdepyc_7001_firmware*cpe:2.3:o:amd:epyc_7001_firmware:*:*:*:*:*:*:*:*
amdepyc_7001-cpe:2.3:h:amd:epyc_7001:-:*:*:*:*:*:*:*
amdepyc_7232p_firmware*cpe:2.3:o:amd:epyc_7232p_firmware:*:*:*:*:*:*:*:*
amdepyc_7232p-cpe:2.3:h:amd:epyc_7232p:-:*:*:*:*:*:*:*
amdepyc_7252_firmware*cpe:2.3:o:amd:epyc_7252_firmware:*:*:*:*:*:*:*:*
amdepyc_7252-cpe:2.3:h:amd:epyc_7252:-:*:*:*:*:*:*:*
amdepyc_7262_firmware*cpe:2.3:o:amd:epyc_7262_firmware:*:*:*:*:*:*:*:*
amdepyc_7262-cpe:2.3:h:amd:epyc_7262:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
amd	epyc_7002_firmware	*	cpe:2.3:o:amd:epyc_7002_firmware::::::::
amd	epyc_7002	-	cpe:2.3:h:amd:epyc_7002:-:::::::*
amd	epyc_7001_firmware	*	cpe:2.3:o:amd:epyc_7001_firmware::::::::
amd	epyc_7001	-	cpe:2.3:h:amd:epyc_7001:-:::::::*
amd	epyc_7232p_firmware	*	cpe:2.3:o:amd:epyc_7232p_firmware::::::::
amd	epyc_7232p	-	cpe:2.3:h:amd:epyc_7232p:-:::::::*
amd	epyc_7252_firmware	*	cpe:2.3:o:amd:epyc_7252_firmware::::::::
amd	epyc_7252	-	cpe:2.3:h:amd:epyc_7252:-:::::::*
amd	epyc_7262_firmware	*	cpe:2.3:o:amd:epyc_7262_firmware::::::::
amd	epyc_7262	-	cpe:2.3:h:amd:epyc_7262:-:::::::*

Rows per page:

1-10 of 761

CNA Affected

[
  {
    "product": "1st Gen AMD EPYC™",
    "vendor": "AMD",
    "versions": [
      {
        "lessThan": "NaplesPI-SP3_1.0.0.G",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "2nd Gen AMD EPYC™",
    "vendor": "AMD",
    "versions": [
      {
        "lessThan": "RomePI-SP3_1.0.0.C",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

www.amd.com/en/corporate/product-security/bulletin/amd-sb-1021

Social References

CVSS2

6.6

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:C/I:C/A:N

CVSS3

7.1

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

AI Score

7.1

Confidence

High

EPSS

Percentile

12.6%

JSON

Related for CVE-2021-26408