CVE-2021-26315 Vulnerability Details

  /     /     /  

CVE-2021-26315 Metadata Quick Info

CVE Published: 16/11/2021 | CVE Updated: 17/09/2024 | CVE Year: 2021
Source: AMD | Vendor: AMD | Product: 3rd Gen AMD EPYC™
Status : PUBLISHED

---

CVE-2021-26315 Description

When the AMD Platform Security Processor (PSP) boot rom loads, authenticates, and subsequently decrypts an encrypted FW, due to insufficient verification of the integrity of decrypted image, arbitrary code may be executed in the PSP when encrypted firmware images are used.

Metrics

CVSS Version: 3.1 | Base Score: n/a
Vector: n/a

l➤ Exploitability Metrics:
    Attack Vector (AV)*
    Attack Complexity (AC)*
    Privileges Required (PR)*
    User Interaction (UI)*
    Scope (S)*

l➤ Impact Metrics:
    Confidentiality Impact (C)*
    Integrity Impact (I)*
    Availability Impact (A)*

Weakness Enumeration (CWE)

CWE-ID: CWE-345
CWE Name: CWE-345 Insufficient Verification of Data Authenticity
Source: AMD

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).