AMD Embedded Processors Multiple Firmware Vulnerabilities (CVE-2022-23815/CVE-2021-26344) and Patch Advisory

AMD Embedded Processors Vulnerability Summary (Aug 2024) Vulnerability Overview AMD reported potential vulnerabilities in embedded processors, primarily involving missing or incorrect security checks in firmware (APCB, BIOS, UEFI) and the ASP Secure OS. Attackers may exploit these vulnerabilities to execute arbitrary code, escalate privileges, compromise memory integrity, or cause denial of service. Key CVE Details: CVE-2022-23815 (7.5 High): APCB firmware check flaw, potentially leading to out-of-bounds write and arbitrary code execution. CVE-2021-26344 (7.2 High): Out-of-bounds memory write when processing the AMD PSP1 configuration block, potentially leading to arbitrary code execution. CVE-2022-23817 (7.0 High): Insufficient memory buffer check in the ASP Secure OS, potentially leading to privilege escalation. CVE-2023-20591 (6.5 Medium): IOMMU re-initialization flaw, potentially leading to memory read/modify and loss of confidentiality/integrity/availability. CVE-2021-26367 (5.7 Medium): Incorrect configuration of Trusted Memory Region (TMR) in x86, potentially leading to loss of integrity/availability. CVE-2024-21981 (5.7 Medium): Improper control over key usage in the AMD Secure Processor (ASP), potentially leading to loss of confidentiality/integrity. CVE-2021-46746 (5.2 Medium): Flaw in the ASP TEE stack protection mechanism, potentially leading to denial of service. CVE-2021-26387 (3.9 Low): Insufficient access control in the ASP kernel, potentially leading to loss of platform integrity. CVE-2021-46772 (3.9 Low): Insufficient input validation in ABL, potentially leading to memory corruption or denial of service. CVE-2023-20518 (1.6 Low): Incomplete cleanup in the ASP, potentially leading to leakage of the Main Encryption Key (MEK) and loss of confidentiality. Affected Products Affected products include AMD EPYC™ Embedded 3000/7000 series and AMD Ryzen™ Embedded R/V series processors. List of Affected Products: AMD EPYC™ Embedded 3000 AMD EPYC™ Embedded 7000 AMD Ryzen™ Embedded R1000/R2000 AMD Ryzen™ Embedded V1000/V2000 AMD EPYC™ Embedded 5000 AMD Ryzen™ Embedded 7000 AMD EPYC™ Embedded 9003 AMD Ryzen™ Embedded V3000 Mitigation AMD recommends updating to the following specified Platform Initialization (PI) firmware versions to mitigate the vulnerabilities. Firmware Update Recommendations: Note: Some CVEs are marked as "No fix planned" or "Not affected" on specific products. POC/Exploit Code No POC code or exploit code is included in the page.

Goal Reached Thanks to every supporter — we hit 100%!

AMD Embedded Processors Multiple Firmware Vulnerabilities (CVE-2022-23815/CVE-2021-26344) and Patch Advisory