CVE-2021-26343
MEDIUMCVSS 5.5/10EPSS 0.18%
Last modified
CVE-2021-26343 is a medium-severity vulnerability rated 5.5/10 on the CVSS scale. Insufficient validation in ASP BIOS and DRTM commands may allow malicious supervisor x86 software to disclose the contents of sensitive memory which may result in information disclosure. . EPSS estimates a 0.18% chance of exploitation in the next 30 days.
Description
Insufficient validation in ASP BIOS and DRTM commands may allow malicious supervisor x86 software to disclose the contents of sensitive memory which may result in information disclosure.
Metrics
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Amd | Epyc 7003 Firmware | < milanpi_1.0.0.3 |
| Amd | Epyc 72f3 Firmware | < milanpi_1.0.0.3 |
| Amd | Epyc 7313 Firmware | < milanpi_1.0.0.3 |
| Amd | Epyc 7313p Firmware | < milanpi_1.0.0.3 |
| Amd | Epyc 7343 Firmware | < milanpi_1.0.0.3 |
| Amd | Epyc 7373x Firmware | < milanpi_1.0.0.3 |
| Amd | Epyc 73f3 Firmware | < milanpi_1.0.0.3 |
| Amd | Epyc 7413 Firmware | < milanpi_1.0.0.3 |
| Amd | Epyc 7443 Firmware | < milanpi_1.0.0.3 |
| Amd | Epyc 7443p Firmware | < milanpi_1.0.0.3 |
| Amd | Epyc 7453 Firmware | < milanpi_1.0.0.3 |
| Amd | Epyc 74f3 Firmware | < milanpi_1.0.0.3 |
| Amd | Epyc 7513 Firmware | < milanpi_1.0.0.3 |
| Amd | Epyc 7543 Firmware | < milanpi_1.0.0.3 |
| Amd | Epyc 7543p Firmware | < milanpi_1.0.0.3 |
| Amd | Epyc 7573x Firmware | < milanpi_1.0.0.3 |
| Amd | Epyc 75f3 Firmware | < milanpi_1.0.0.3 |
| Amd | Epyc 7643 Firmware | < milanpi_1.0.0.3 |
| Amd | Epyc 7663 Firmware | < milanpi_1.0.0.3 |
| Amd | Epyc 7713 Firmware | < milanpi_1.0.0.3 |
| Amd | Epyc 7713p Firmware | < milanpi_1.0.0.3 |
| Amd | Epyc 7743 Firmware | < milanpi_1.0.0.3 |
| Amd | Epyc 7763 Firmware | < milanpi_1.0.0.3 |
| Amd | Epyc 7773x Firmware | < milanpi_1.0.0.3 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-26343?
Insufficient validation in ASP BIOS and DRTM commands may allow malicious supervisor x86 software to disclose the contents of sensitive memory which may result in information disclosure.
How severe is CVE-2021-26343?
CVE-2021-26343 has a CVSS score of 5.5/10 (MEDIUM severity). The EPSS model estimates a 0.18% probability of exploitation in the next 30 days.
How do I fix CVE-2021-26343?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
Are you affected by CVE-2021-26343?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST