CVE-2021-26355
MEDIUMCVSS 5.5/10EPSS 0.17%
Last modified
CVE-2021-26355 is a medium-severity vulnerability rated 5.5/10 on the CVSS scale. Insufficient fencing and checks in System Management Unit (SMU) may result in access to invalid message port registers that could result in a potential denial-of-service. . EPSS estimates a 0.17% chance of exploitation in the next 30 days.
Description
Insufficient fencing and checks in System Management Unit (SMU) may result in access to invalid message port registers that could result in a potential denial-of-service.
Metrics
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Amd | Epyc 7003 Firmware | < milanpi-sp3_1.0.0.7 |
| Amd | Epyc 72f3 Firmware | < milanpi-sp3_1.0.0.7 |
| Amd | Epyc 7313 Firmware | < milanpi-sp3_1.0.0.7 |
| Amd | Epyc 7313p Firmware | < milanpi-sp3_1.0.0.7 |
| Amd | Epyc 7343 Firmware | < milanpi-sp3_1.0.0.7 |
| Amd | Epyc 7373x Firmware | < milanpi-sp3_1.0.0.7 |
| Amd | Epyc 73f3 Firmware | < milanpi-sp3_1.0.0.7 |
| Amd | Epyc 7413 Firmware | < milanpi-sp3_1.0.0.7 |
| Amd | Epyc 7443 Firmware | < milanpi-sp3_1.0.0.7 |
| Amd | Epyc 7443p Firmware | < milanpi-sp3_1.0.0.7 |
| Amd | Epyc 7453 Firmware | < milanpi-sp3_1.0.0.7 |
| Amd | Epyc 74f3 Firmware | < milanpi-sp3_1.0.0.7 |
| Amd | Epyc 7513 Firmware | < milanpi-sp3_1.0.0.7 |
| Amd | Epyc 7543 Firmware | < milanpi-sp3_1.0.0.7 |
| Amd | Epyc 7543p Firmware | < milanpi-sp3_1.0.0.7 |
| Amd | Epyc 7573x Firmware | < milanpi-sp3_1.0.0.7 |
| Amd | Epyc 75f3 Firmware | < milanpi-sp3_1.0.0.7 |
| Amd | Epyc 7643 Firmware | < milanpi-sp3_1.0.0.7 |
| Amd | Epyc 7663 Firmware | < milanpi-sp3_1.0.0.7 |
| Amd | Epyc 7713 Firmware | < milanpi-sp3_1.0.0.7 |
| Amd | Epyc 7713p Firmware | < milanpi-sp3_1.0.0.7 |
| Amd | Epyc 7743 Firmware | < milanpi-sp3_1.0.0.7 |
| Amd | Epyc 7763 Firmware | < milanpi-sp3_1.0.0.7 |
| Amd | Epyc 7773x Firmware | < milanpi-sp3_1.0.0.7 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-26355?
Insufficient fencing and checks in System Management Unit (SMU) may result in access to invalid message port registers that could result in a potential denial-of-service.
How severe is CVE-2021-26355?
CVE-2021-26355 has a CVSS score of 5.5/10 (MEDIUM severity). The EPSS model estimates a 0.17% probability of exploitation in the next 30 days.
How do I fix CVE-2021-26355?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-26349Failure to assign a new report ID to an imported guest may p…5.5
- CVE-2021-26350A TOCTOU race condition in SMU may allow for the caller to o…4.7
- CVE-2021-26351Insufficient DRAM address validation in System Management Un…5.5
- CVE-2021-26352Insufficient bound checks in System Management Unit (SMU) PC…5.5
- CVE-2021-26353Failure to validate inputs in SMM may allow an attacker to c…7.8
- CVE-2021-26354Insufficient bounds checking in ASP may allow an attacker to…5.5
- CVE-2021-26356A TOCTOU in ASP bootloader may allow an attacker to tamper w…7.4
- CVE-2021-26357Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2021-26358Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2021-26360An attacker with local access to the system can make unautho…7.8
- CVE-2021-26361A malicious or compromised User Application (UApp) or AGESA …5.5
- CVE-2021-26362A malicious or compromised UApp or ABL may be used by an att…7.1
Are you affected by CVE-2021-26355?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST