Strix
26.1K

CVE-2021-26340

HIGHCVSS 8.4/10EPSS 0.24%

Last modified

CVE-2021-26340 is a high-severity vulnerability rated 8.4/10 on the CVSS scale. A malicious hypervisor in conjunction with an unprivileged attacker process inside an SEV/SEV-ES guest VM may fail to flush the Translation Lookaside Buffer (TLB) resulting in unexpected behavior inside the virtual machine (VM).. EPSS estimates a 0.24% chance of exploitation in the next 30 days.

Description

A malicious hypervisor in conjunction with an unprivileged attacker process inside an SEV/SEV-ES guest VM may fail to flush the Translation Lookaside Buffer (TLB) resulting in unexpected behavior inside the virtual machine (VM).

Metrics

CVSS 3.1
8.4/10

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

EPSS Probability
0.24%

14.9th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

VendorProductVersions
AmdEpyc 7001 FirmwareAll versions
AmdEpyc 7232p FirmwareAll versions
AmdEpyc 7251 FirmwareAll versions
AmdEpyc 7261 FirmwareAll versions
AmdEpyc 7252 FirmwareAll versions
AmdEpyc 74f3 FirmwareAll versions
AmdEpyc 7501 FirmwareAll versions
AmdEpyc 7502 FirmwareAll versions
AmdEpyc 7502p FirmwareAll versions
AmdEpyc 7513 FirmwareAll versions
AmdEpyc 7532 FirmwareAll versions
AmdEpyc 7542 FirmwareAll versions
AmdEpyc 7543 FirmwareAll versions
AmdEpyc 7543p FirmwareAll versions
AmdEpyc 7551 FirmwareAll versions
AmdEpyc 7551p FirmwareAll versions
AmdEpyc 7552 FirmwareAll versions
AmdEpyc 75f3 FirmwareAll versions
AmdEpyc 7601 FirmwareAll versions
AmdEpyc 7642 FirmwareAll versions
AmdEpyc 7643 FirmwareAll versions
AmdEpyc 7662 FirmwareAll versions
AmdEpyc 7663 FirmwareAll versions
AmdEpyc 7702p FirmwareAll versions
AmdEpyc 7702 FirmwareAll versions
AmdEpyc 7713 FirmwareAll versions
AmdEpyc 7713p FirmwareAll versions
AmdEpyc 7742 FirmwareAll versions
AmdEpyc 7763 FirmwareAll versions
AmdEpyc 7f32 FirmwareAll versions
AmdEpyc 7f52 FirmwareAll versions
AmdEpyc 7262 FirmwareAll versions
AmdEpyc 7272 FirmwareAll versions
AmdEpyc 7281 FirmwareAll versions
AmdEpyc 7282 FirmwareAll versions
AmdEpyc 72f3 FirmwareAll versions
AmdEpyc 7302 FirmwareAll versions
AmdEpyc 7301 FirmwareAll versions
AmdEpyc 7302p FirmwareAll versions
AmdEpyc 7313 FirmwareAll versions
AmdEpyc 7313p FirmwareAll versions
AmdEpyc 7343 FirmwareAll versions
AmdEpyc 7351 FirmwareAll versions
AmdEpyc 7351p FirmwareAll versions
AmdEpyc 7352 FirmwareAll versions
AmdEpyc 7371 FirmwareAll versions
AmdEpyc 73f3 FirmwareAll versions
AmdEpyc 7401 FirmwareAll versions
AmdEpyc 7401p FirmwareAll versions
AmdEpyc 7402 FirmwareAll versions

Showing 50 of 105 affected configurations. See NVD for the full list.

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2021-26340?
A malicious hypervisor in conjunction with an unprivileged attacker process inside an SEV/SEV-ES guest VM may fail to flush the Translation Lookaside Buffer (TLB) resulting in unexpected behavior inside the virtual machine (VM).
How severe is CVE-2021-26340?
CVE-2021-26340 has a CVSS score of 8.4/10 (HIGH severity). The EPSS model estimates a 0.24% probability of exploitation in the next 30 days.
How do I fix CVE-2021-26340?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2021-26340?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST