SB2024100225 - Multiple vulnerabilities in AMD EPYC processors

Description

This security bulletin contains information about 7 vulnerabilities.

1) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2023-20578)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to improper handling of certain special address ranges with invalid device table entries (DTEs). A local user can induce DTE faults to bypass RMP checks in SEV-SNP.

2) Out-of-bounds write (CVE-ID: CVE-2021-26344)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error when processing the AMD PSP1 Configuration Block (APCB). A local user can trigger an out-of-bounds write, modify the APCB block and execute arbitrary code on the target system.

3) Improper Initialization (CVE-ID: CVE-2023-20591)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a malicious guest to compromise the affected system.

The vulnerability exists due to improper initialization of IOMMU during the DRTM event. A malicious guest can read or modify hypervisor memory.

4) Input validation error (CVE-ID: CVE-2023-20584)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to insufficient validation of special address ranges with invalid device table entries (DTEs) in IOMMU. A local user can induce DTE faults to bypass RMP checks in SEV-SNP.

5) Incomplete cleanup (CVE-ID: CVE-2023-31356)

CWE-ID: CWE-459 - Incomplete cleanup

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to incomplete system memory cleanup in SEV firmware. A local privileged user can corrupt guest private memory.

6) Out-of-bounds write (CVE-ID: CVE-2021-46772)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation in the ABL. A local privileged user with access to the BIOS menu or UEFI shell can tamper with the structure headers in SPI ROM and perform a denial of service (DoS) attack.

7) Incomplete cleanup (CVE-ID: CVE-2023-20518)

CWE-ID: CWE-459 - Incomplete cleanup

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to incomplete cleanup in the ASP. A local privileged user with access to the BIOS menu or UEFI shell can obtain the Master Encryption Key (MEK).

Remediation

Install update from vendor's website.

References

• https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3003.html