Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2021-26402: Insufficient bounds checking in ASP (AMD Secure Processor) firmware while handling BIOS mailbox commands, may allow an attacker to write partially-controlled data out-of-bounds to SMM or SEV-ES reg...

CVE-2021-26402 · published 3 years ago

Summary

Insufficient bounds checking in ASP (AMD Secure Processor) firmware while handling BIOS mailbox commands, may allow an attacker to write partially-controlled data out-of-bounds to SMM or SEV-ES regions which may lead to a potential loss of integrity and availability.

What to do

Update amd epyc_7h12_firmware to version romepi_1.0.0.c or later.
Update amd epyc_7f72_firmware to version romepi_1.0.0.c or later.
Update amd epyc_7f52_firmware to version romepi_1.0.0.c or later.
Update amd epyc_7f32_firmware to version romepi_1.0.0.c or later.
Update amd epyc_7742_firmware to version romepi_1.0.0.c or later.
Update amd epyc_7702p_firmware to version romepi_1.0.0.c or later.
Update amd epyc_7702_firmware to version romepi_1.0.0.c or later.
Update amd epyc_7662_firmware to version romepi_1.0.0.c or later.
Update amd epyc_7642_firmware to version romepi_1.0.0.c or later.
Update amd epyc_7552_firmware to version romepi_1.0.0.c or later.
Update amd epyc_7542_firmware to version romepi_1.0.0.c or later.
Update amd epyc_7532_firmware to version romepi_1.0.0.c or later.
Update amd epyc_7502p_firmware to version romepi_1.0.0.c or later.
Update amd epyc_7502_firmware to version romepi_1.0.0.c or later.
Update amd epyc_7452_firmware to version romepi_1.0.0.c or later.
Update amd epyc_7402_firmware to version romepi_1.0.0.c or later.
Update amd epyc_7402p_firmware to version romepi_1.0.0.c or later.
Update amd epyc_7352_firmware to version romepi_1.0.0.c or later.
Update amd epyc_7302p_firmware to version romepi_1.0.0.c or later.
Update amd epyc_7302_firmware to version romepi_1.0.0.c or later.
Update amd epyc_7282_firmware to version romepi_1.0.0.c or later.
Update amd epyc_7272_firmware to version romepi_1.0.0.c or later.
Update amd epyc_7262_firmware to version romepi_1.0.0.c or later.
Update amd epyc_7252_firmware to version romepi_1.0.0.c or later.
Update amd epyc_7232p_firmware to version romepi_1.0.0.c or later.
Update amd epyc_7002_firmware to version romepi_1.0.0.c or later.
Update amd epyc_7003_firmware to version milanpi_1.0.0.4 or later.
Update amd epyc_72f3_firmware to version milanpi_1.0.0.4 or later.
Update amd epyc_7313_firmware to version milanpi_1.0.0.4 or later.
Update amd epyc_7313p_firmware to version milanpi_1.0.0.4 or later.
Update amd epyc_7343_firmware to version milanpi_1.0.0.4 or later.
Update amd epyc_7373x_firmware to version milanpi_1.0.0.4 or later.
Update amd epyc_73f3_firmware to version milanpi_1.0.0.4 or later.
Update amd epyc_7413_firmware to version milanpi_1.0.0.4 or later.
Update amd epyc_7443_firmware to version milanpi_1.0.0.4 or later.
Update amd epyc_7443p_firmware to version milanpi_1.0.0.4 or later.
Update amd epyc_7453_firmware to version milanpi_1.0.0.4 or later.
Update amd epyc_74f3_firmware to version milanpi_1.0.0.4 or later.
Update amd epyc_7513_firmware to version milanpi_1.0.0.4 or later.
Update amd epyc_7543_firmware to version milanpi_1.0.0.4 or later.
Update amd epyc_7543p_firmware to version milanpi_1.0.0.4 or later.
Update amd epyc_7573x_firmware to version milanpi_1.0.0.4 or later.
Update amd epyc_75f3_firmware to version milanpi_1.0.0.4 or later.
Update amd epyc_7643_firmware to version milanpi_1.0.0.4 or later.
Update amd epyc_7663_firmware to version milanpi_1.0.0.4 or later.
Update amd epyc_7713_firmware to version milanpi_1.0.0.4 or later.
Update amd epyc_7713p_firmware to version milanpi_1.0.0.4 or later.
Update amd epyc_7743_firmware to version milanpi_1.0.0.4 or later.
Update amd epyc_7763_firmware to version milanpi_1.0.0.4 or later.
Update amd epyc_7773x_firmware to version milanpi_1.0.0.4 or later.

Affected software

Vendor	Product	Affected versions
amd	epyc_7h12_firmware	< romepi_1.0.0.c `cpe:2.3:o:amd:epyc_7h12_firmware::::::::`
amd	epyc_7f72_firmware	< romepi_1.0.0.c `cpe:2.3:o:amd:epyc_7f72_firmware::::::::`
amd	epyc_7f52_firmware	< romepi_1.0.0.c `cpe:2.3:o:amd:epyc_7f52_firmware::::::::`
amd	epyc_7f32_firmware	< romepi_1.0.0.c `cpe:2.3:o:amd:epyc_7f32_firmware::::::::`
amd	epyc_7742_firmware	< romepi_1.0.0.c `cpe:2.3:o:amd:epyc_7742_firmware::::::::`
amd	epyc_7702p_firmware	< romepi_1.0.0.c `cpe:2.3:o:amd:epyc_7702p_firmware::::::::`
amd	epyc_7702_firmware	< romepi_1.0.0.c `cpe:2.3:o:amd:epyc_7702_firmware::::::::`
amd	epyc_7662_firmware	< romepi_1.0.0.c `cpe:2.3:o:amd:epyc_7662_firmware::::::::`
amd	epyc_7642_firmware	< romepi_1.0.0.c `cpe:2.3:o:amd:epyc_7642_firmware::::::::`
amd	epyc_7552_firmware	< romepi_1.0.0.c `cpe:2.3:o:amd:epyc_7552_firmware::::::::`
amd	epyc_7542_firmware	< romepi_1.0.0.c `cpe:2.3:o:amd:epyc_7542_firmware::::::::`
amd	epyc_7532_firmware	< romepi_1.0.0.c `cpe:2.3:o:amd:epyc_7532_firmware::::::::`
amd	epyc_7502p_firmware	< romepi_1.0.0.c `cpe:2.3:o:amd:epyc_7502p_firmware::::::::`
amd	epyc_7502_firmware	< romepi_1.0.0.c `cpe:2.3:o:amd:epyc_7502_firmware::::::::`
amd	epyc_7452_firmware	< romepi_1.0.0.c `cpe:2.3:o:amd:epyc_7452_firmware::::::::`
amd	epyc_7402_firmware	< romepi_1.0.0.c `cpe:2.3:o:amd:epyc_7402_firmware::::::::`
amd	epyc_7402p_firmware	< romepi_1.0.0.c `cpe:2.3:o:amd:epyc_7402p_firmware::::::::`
amd	epyc_7352_firmware	< romepi_1.0.0.c `cpe:2.3:o:amd:epyc_7352_firmware::::::::`
amd	epyc_7302p_firmware	< romepi_1.0.0.c `cpe:2.3:o:amd:epyc_7302p_firmware::::::::`
amd	epyc_7302_firmware	< romepi_1.0.0.c `cpe:2.3:o:amd:epyc_7302_firmware::::::::`
amd	epyc_7282_firmware	< romepi_1.0.0.c `cpe:2.3:o:amd:epyc_7282_firmware::::::::`
amd	epyc_7272_firmware	< romepi_1.0.0.c `cpe:2.3:o:amd:epyc_7272_firmware::::::::`
amd	epyc_7262_firmware	< romepi_1.0.0.c `cpe:2.3:o:amd:epyc_7262_firmware::::::::`
amd	epyc_7252_firmware	< romepi_1.0.0.c `cpe:2.3:o:amd:epyc_7252_firmware::::::::`
amd	epyc_7232p_firmware	< romepi_1.0.0.c `cpe:2.3:o:amd:epyc_7232p_firmware::::::::`
amd	epyc_7002_firmware	< romepi_1.0.0.c `cpe:2.3:o:amd:epyc_7002_firmware::::::::`
amd	epyc_7003_firmware	< milanpi_1.0.0.4 `cpe:2.3:o:amd:epyc_7003_firmware::::::::`
amd	epyc_72f3_firmware	< milanpi_1.0.0.4 `cpe:2.3:o:amd:epyc_72f3_firmware::::::::`
amd	epyc_7313_firmware	< milanpi_1.0.0.4 `cpe:2.3:o:amd:epyc_7313_firmware::::::::`
amd	epyc_7313p_firmware	< milanpi_1.0.0.4 `cpe:2.3:o:amd:epyc_7313p_firmware::::::::`
amd	epyc_7343_firmware	< milanpi_1.0.0.4 `cpe:2.3:o:amd:epyc_7343_firmware::::::::`
amd	epyc_7373x_firmware	< milanpi_1.0.0.4 `cpe:2.3:o:amd:epyc_7373x_firmware::::::::`
amd	epyc_73f3_firmware	< milanpi_1.0.0.4 `cpe:2.3:o:amd:epyc_73f3_firmware::::::::`
amd	epyc_7413_firmware	< milanpi_1.0.0.4 `cpe:2.3:o:amd:epyc_7413_firmware::::::::`
amd	epyc_7443_firmware	< milanpi_1.0.0.4 `cpe:2.3:o:amd:epyc_7443_firmware::::::::`
amd	epyc_7443p_firmware	< milanpi_1.0.0.4 `cpe:2.3:o:amd:epyc_7443p_firmware::::::::`
amd	epyc_7453_firmware	< milanpi_1.0.0.4 `cpe:2.3:o:amd:epyc_7453_firmware::::::::`
amd	epyc_74f3_firmware	< milanpi_1.0.0.4 `cpe:2.3:o:amd:epyc_74f3_firmware::::::::`
amd	epyc_7513_firmware	< milanpi_1.0.0.4 `cpe:2.3:o:amd:epyc_7513_firmware::::::::`
amd	epyc_7543_firmware	< milanpi_1.0.0.4 `cpe:2.3:o:amd:epyc_7543_firmware::::::::`
amd	epyc_7543p_firmware	< milanpi_1.0.0.4 `cpe:2.3:o:amd:epyc_7543p_firmware::::::::`
amd	epyc_7573x_firmware	< milanpi_1.0.0.4 `cpe:2.3:o:amd:epyc_7573x_firmware::::::::`
amd	epyc_75f3_firmware	< milanpi_1.0.0.4 `cpe:2.3:o:amd:epyc_75f3_firmware::::::::`
amd	epyc_7643_firmware	< milanpi_1.0.0.4 `cpe:2.3:o:amd:epyc_7643_firmware::::::::`
amd	epyc_7663_firmware	< milanpi_1.0.0.4 `cpe:2.3:o:amd:epyc_7663_firmware::::::::`
amd	epyc_7713_firmware	< milanpi_1.0.0.4 `cpe:2.3:o:amd:epyc_7713_firmware::::::::`
amd	epyc_7713p_firmware	< milanpi_1.0.0.4 `cpe:2.3:o:amd:epyc_7713p_firmware::::::::`
amd	epyc_7743_firmware	< milanpi_1.0.0.4 `cpe:2.3:o:amd:epyc_7743_firmware::::::::`
amd	epyc_7763_firmware	< milanpi_1.0.0.4 `cpe:2.3:o:amd:epyc_7763_firmware::::::::`
amd	epyc_7773x_firmware	< milanpi_1.0.0.4 `cpe:2.3:o:amd:epyc_7773x_firmware::::::::`

Original advisory text

References

https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

7.1 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-787Out-of-bounds Write

Timeline

Published11 Jan 2023

Updated30 Oct 2026

First seen29 Sep 2026

Sources

CVE-2021-26402 · NVD

Track software like this

Free during beta