SB2023110670 - Multiple vulnerabilities in Certain HPE ProLiant DL/DX/XL Server Using Certain AMD EPYC Processors, AMD-SB-3002, AMD Server

Description

This security bulletin contains information about 10 vulnerabilities.

1) Buffer overflow (CVE-ID: CVE-2022-23820)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to improper validation of the AMD SMM communication buffer. A local user can corrupt the SMRAM and execute arbitrary code on the system.

2) Out-of-bounds write (CVE-ID: CVE-2021-46774)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error when processing DRAM address in System Management Unit (SMU). A local user can trigger an out-of-bounds write and perform a denial of service (DoS) attack.

3) Out-of-bounds write (CVE-ID: CVE-2023-20533)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error when processing DRAM address in System Management Unit (SMU). A local user can trigger an out-of-bounds write and perform a denial of service (DoS) attack.

4) Use-after-free (CVE-ID: CVE-2023-20519)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error in the management of an SNP guest context page. A malicious hypervisor can masquerade as the guest's migration agent and perform a denial of service (DoS) attack.

5) Input validation error (CVE-ID: CVE-2023-20566)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to insufficient validation of user-supplied input n ASP with SNP enabled. A local user can compromise guest memory integrity.

6) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2023-20521)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows an attacker to perform a denial of service attack.

The vulnerability exists due to a race condition in ASP Bootloader. An attacker with physical access to device can tamper with SPI ROM records after memory content verification and gain access to sensitive information of perform a denial of service (DoS) attack.

7) Incomplete cleanup (CVE-ID: CVE-2021-46766)

CWE-ID: CWE-459 - Incomplete cleanup

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to incomplete clearing of sensitive data in the ASP Bootloader. A local user with access to ASP SRAM can gain access to sensitive information.

8) Configuration (CVE-ID: CVE-2022-23830)

CWE-ID: CWE-16 - Configuration

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The issue may allow a local user to bypass implemented security restrictions.

The issue exists due to immutable SMM configuration when SNP is enabled. A local user can modify guest memory.

9) Input validation error (CVE-ID: CVE-2023-20526)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows an attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied input in the ASP Bootloader. An attacker with physical access to device can read contents of ASP memory.

10) Out-of-bounds read (CVE-ID: CVE-2021-26345)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary condition in APCB. A local user can trigger an out-of-bounds read error and perform a denial of service (DoS) attack.

Remediation

Install update from vendor's website.

References

• https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbhf04550en_us