SB2020062311 - Privilege escalation in AMD Generic Encapsulated Software Architecture (AGESA)

Description

This security bulletin contains information about 1 vulnerability.

1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2020-12890)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: CVSS:4.0/AV:P/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to escalate privileges on the system.

The vulnerability exists due to improper security restrictions in AMD’s client and embedded processors that came out between 2016 and 2019. An authenticated attacker with physical access can manipulate the AMD Generic Encapsulated Software Architecture (AGESA) and execute arbitrary code on the target system.

Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References

• https://www.amd.com/en/corporate/product-security
• https://threatpost.com/amd-fixes-for-high-severity-smm-callout-flaws-upcoming/156787/