Amd Epyc 7743 Firmware — known CVE vulnerabilities

Every CVE whose affected-product data names Amd Epyc 7743 Firmware, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (16)

• CVE-2021-26316 — CVSS 7.8 (high): Failure to validate the communication buffer and communication service in the BIOS may allow an attacker to tamper with the buffer…
• CVE-2021-26398 — CVSS 7.8 (high): Insufficient input validation in SYS_KEY_DERIVE system call in a compromised user application or ABL may allow an attacker to corrupt ASP…
• CVE-2023-20531 — CVSS 7.5 (high): Insufficient bound checks in the SMU may allow an attacker to update the SRAM from/to address space to an invalid value potentially…
• CVE-2023-20530 — CVSS 7.5 (high): Insufficient input validation of BIOS mailbox messages in SMU may result in out-of-bounds memory reads potentially resulting in a denial of…
• CVE-2023-20529 — CVSS 7.5 (high): Insufficient bound checks in the SMU may allow an attacker to update the from/to address space to an invalid value potentially resulting in…
• CVE-2021-26402 — CVSS 7.1 (high): Insufficient bounds checking in ASP (AMD Secure Processor) firmware while handling BIOS mailbox commands, may allow an attacker to write…
• CVE-2023-20525 — CVSS 6.5 (medium): Insufficient syscall input validation in the ASP Bootloader may allow a privileged attacker to read memory outside the bounds of a mapped…
• CVE-2023-20527 — CVSS 6.5 (medium): Improper syscall input validation in the ASP Bootloader may allow a privileged attacker to read memory out-of-bounds, potentially leading…
• CVE-2023-20523 — CVSS 5.7 (medium): TOCTOU in the ASP may allow a physical attacker to write beyond the buffer bounds, potentially leading to a loss of integrity or denial of…
• CVE-2021-26343 — CVSS 5.5 (medium): Insufficient validation in ASP BIOS and DRTM commands may allow malicious supervisor x86 software to disclose the contents of sensitive…
• CVE-2021-26355 — CVSS 5.5 (medium): Insufficient fencing and checks in System Management Unit (SMU) may result in access to invalid message port registers that could result in…
• CVE-2023-20532 — CVSS 5.3 (medium): Insufficient input validation in the SMU may allow an attacker to improperly lock resources, potentially resulting in a denial of service.
• CVE-2023-20594 — CVSS 4.4 (medium): Improper initialization of variables in the DXE driver may allow a privileged user to leak sensitive information via local access.
• CVE-2021-26396 — CVSS 4.4 (medium): Insufficient validation of address mapping to IO in ASP (AMD Secure Processor) may result in a loss of memory integrity in the SNP guest.
• CVE-2021-26328 — CVSS 4.4 (medium): Failure to verify the mode of CPU execution at the time of SNP_INIT may lead to a potential loss of memory integrity for SNP guests.
• CVE-2023-20528 — CVSS 2.4 (low): Insufficient input validation in the SMU may allow a physical attacker to exfiltrate SMU memory contents over the I2C bus potentially…