Resource management error in 3rd Gen AMD EPYC Processors - CVE-2021-26348

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU63685

Resource management error in 3rd Gen AMD EPYC Processors - CVE-2021-26348

Published: May 25, 2022


Vulnerability identifier: #VU63685
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-26348
CWE-ID: CWE-399
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to failure to flush the Translation Lookaside Buffer (TLB) of the I/O memory management unit (IOMMU). A local user can force the IO device into writing data to memory it should not be able to access.


Affected software

3rd Gen AMD EPYC Processors
HPE ProLiant DL385 Gen10 Server
HPE ProLiant DL325 Gen10 Server
HPE ProLiant DL385 Gen10 Plus server
HPE ProLiant DL325 Gen10 Plus server
SUSE Manager Proxy
SUSE Manager Server
SUSE Linux Enterprise Micro
SUSE OpenStack Cloud
SUSE OpenStack Cloud Crowbar
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Server
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Desktop
openSUSE Leap
Dell EMC NetWorker vProxy
R7425
R7415
R6415
XE8545
R7525
R6525
R7515
R6515
C6525
ucode-amd
kernel-firmware
kernel-firmware-ath10k
kernel-firmware-mellanox
kernel-firmware-mediatek
kernel-firmware-media
kernel-firmware-marvell
kernel-firmware-liquidio
kernel-firmware-iwlwifi
kernel-firmware-intel
kernel-firmware-all
kernel-firmware-amdgpu
kernel-firmware-i915
kernel-firmware-ath11k
kernel-firmware-atheros
kernel-firmware-bluetooth
kernel-firmware-bnx2
kernel-firmware-brcm
kernel-firmware-chelsio
kernel-firmware-dpaa2
kernel-firmware-network
kernel-firmware-usb-network
kernel-firmware-ueagle
kernel-firmware-ti
kernel-firmware-sound
kernel-firmware-serial
kernel-firmware-realtek
kernel-firmware-radeon
kernel-firmware-qlogic
kernel-firmware-prestera
kernel-firmware-platform
kernel-firmware-nvidia
kernel-firmware-nfp
kernel-firmware-mwifiex
kernel-firmware-qcom

How to mitigate CVE-2021-26348

Install updates from vendor's website.

3rd Gen AMD EPYC Processors - update to MilanPI-SP3_1.0.0.7
Dell EMC NetWorker vProxy - update to 4.3.0-32
R7425 - update to 1.18.0
R7415 - update to 1.18.0
R6415 - update to 1.18.0
XE8545 - update to 2.6.6
R7525 - update to 2.6.6
R6525 - update to 2.6.6
R7515 - update to 2.6.6
R6515 - update to 2.6.6
C6525 - update to 2.6.7
HPE ProLiant DL385 Gen10 Server - update to 2.56
HPE ProLiant DL325 Gen10 Server - update to 2.56
HPE ProLiant DL385 Gen10 Plus server - update to 2.56
HPE ProLiant DL325 Gen10 Plus server - update to 2.56
ucode-amd - addressed in versions 20190618-5.25.2, 20191118-150000.3.42.1, 20210208-150300.4.10.1, 20220509-150400.4.5.1
kernel-firmware - addressed in versions 20190618-5.25.2, 20191118-150000.3.42.1, 20210208-150300.4.10.1, 20220509-150400.4.5.1
kernel-firmware-ath10k - addressed in versions 20210208-150300.4.10.1, 20220509-150400.4.5.1
kernel-firmware-mellanox - addressed in versions 20210208-150300.4.10.1, 20220509-150400.4.5.1
kernel-firmware-mediatek - addressed in versions 20210208-150300.4.10.1, 20220509-150400.4.5.1
kernel-firmware-media - addressed in versions 20210208-150300.4.10.1, 20220509-150400.4.5.1
kernel-firmware-marvell - addressed in versions 20210208-150300.4.10.1, 20220509-150400.4.5.1
kernel-firmware-liquidio - addressed in versions 20210208-150300.4.10.1, 20220509-150400.4.5.1
kernel-firmware-iwlwifi - addressed in versions 20210208-150300.4.10.1, 20220509-150400.4.5.1
kernel-firmware-intel - addressed in versions 20210208-150300.4.10.1, 20220509-150400.4.5.1
kernel-firmware-all - addressed in versions 20210208-150300.4.10.1, 20220509-150400.4.5.1
kernel-firmware-amdgpu - addressed in versions 20210208-150300.4.10.1, 20220509-150400.4.5.1
kernel-firmware-i915 - addressed in versions 20210208-150300.4.10.1, 20220509-150400.4.5.1
kernel-firmware-ath11k - addressed in versions 20210208-150300.4.10.1, 20220509-150400.4.5.1
kernel-firmware-atheros - addressed in versions 20210208-150300.4.10.1, 20220509-150400.4.5.1
kernel-firmware-bluetooth - addressed in versions 20210208-150300.4.10.1, 20220509-150400.4.5.1
kernel-firmware-bnx2 - addressed in versions 20210208-150300.4.10.1, 20220509-150400.4.5.1
kernel-firmware-brcm - addressed in versions 20210208-150300.4.10.1, 20220509-150400.4.5.1
kernel-firmware-chelsio - addressed in versions 20210208-150300.4.10.1, 20220509-150400.4.5.1
kernel-firmware-dpaa2 - addressed in versions 20210208-150300.4.10.1, 20220509-150400.4.5.1
kernel-firmware-network - addressed in versions 20210208-150300.4.10.1, 20220509-150400.4.5.1
kernel-firmware-usb-network - addressed in versions 20210208-150300.4.10.1, 20220509-150400.4.5.1
kernel-firmware-ueagle - addressed in versions 20210208-150300.4.10.1, 20220509-150400.4.5.1
kernel-firmware-ti - addressed in versions 20210208-150300.4.10.1, 20220509-150400.4.5.1
kernel-firmware-sound - addressed in versions 20210208-150300.4.10.1, 20220509-150400.4.5.1
kernel-firmware-serial - addressed in versions 20210208-150300.4.10.1, 20220509-150400.4.5.1
kernel-firmware-realtek - addressed in versions 20210208-150300.4.10.1, 20220509-150400.4.5.1
kernel-firmware-radeon - addressed in versions 20210208-150300.4.10.1, 20220509-150400.4.5.1
kernel-firmware-qlogic - addressed in versions 20210208-150300.4.10.1, 20220509-150400.4.5.1
kernel-firmware-prestera - addressed in versions 20210208-150300.4.10.1, 20220509-150400.4.5.1
kernel-firmware-platform - addressed in versions 20210208-150300.4.10.1, 20220509-150400.4.5.1
kernel-firmware-nvidia - addressed in versions 20210208-150300.4.10.1, 20220509-150400.4.5.1
kernel-firmware-nfp - addressed in versions 20210208-150300.4.10.1, 20220509-150400.4.5.1
kernel-firmware-mwifiex - addressed in versions 20210208-150300.4.10.1, 20220509-150400.4.5.1
kernel-firmware-qcom - update to 20220509-150400.4.5.1

External References

Related Security Bulletins