Time-of-check Time-of-use (TOCTOU) Race Condition in AMD products - CVE-2021-26356

Vulnerability identifier: #VU75925

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-26356

CWE-ID: CWE-367

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to a race condition in ASP bootloader. A local user can tamper with the SPI ROM, corrupt S3 data and gain access to sensitive information.

3rd Gen AMD EPYC Processors
1st Gen AMD EPYC Processors
2nd Gen AMD EPYC Processors
HPE ProLiant XL645d Gen10 Plus Server
HPE ProLiant DL385 Gen10 Plus server
HPE ProLiant DL325 Gen10 Plus server
HPE ProLiant DL365 Gen10 Plus server
HPE ProLiant XL225n Gen10 Plus 1U Node
HPE ProLiant DL325 Gen10 Plus v2 server
HPE ProLiant DL345 Gen10 Plus server
HPE ProLiant DL385 Gen10 Plus v2 server
HPE ProLiant XL675d Gen10 Plus Server
HPE ProLiant DL385 Gen10 Server
HPE ProLiant DL325 Gen10 Server
Cray EX235a
PowerEdge R6415
PowerEdge R7425
PowerEdge R7415
EMC XC Core XC7525
PowerEdge R7525
PowerEdge R6525
PowerEdge R7515
PowerEdge R6515
PowerEdge C6525
PowerEdge XE8545

Install updates from vendor's website.

3rd Gen AMD EPYC Processors - update to MilanPI 1.0.0.6
1st Gen AMD EPYC Processors - update to NaplesPI 1.0.0.H
2nd Gen AMD EPYC Processors - update to RomePI 1.0.0.D
Cray EX235a - update to 1.6.2
PowerEdge R6415 - update to 1.19.0
PowerEdge R7425 - update to 1.19.0
PowerEdge R7415 - update to 1.19.0
EMC XC Core XC7525 - update to 2.9.3
PowerEdge R7525 - update to 2.9.3
PowerEdge R6525 - update to 2.9.3
PowerEdge R7515 - update to 2.9.3
PowerEdge R6515 - update to 2.9.3
PowerEdge C6525 - update to 2.9.4
PowerEdge XE8545 - update to 2.9.4
HPE ProLiant XL645d Gen10 Plus Server - update to 2.60_08-11-2022
HPE ProLiant DL385 Gen10 Plus server - update to 2.60_08-11-2022
HPE ProLiant DL325 Gen10 Plus server - update to 2.60_08-11-2022
HPE ProLiant DL365 Gen10 Plus server - update to 2.60_08-11-2022
HPE ProLiant XL225n Gen10 Plus 1U Node - update to 2.60_08-11-2022
HPE ProLiant DL325 Gen10 Plus v2 server - update to 2.60_08-11-2022
HPE ProLiant DL345 Gen10 Plus server - update to 2.60_08-11-2022
HPE ProLiant DL385 Gen10 Plus v2 server - update to 2.60_08-11-2022
HPE ProLiant XL675d Gen10 Plus Server - update to 2.60_08-11-2022
HPE ProLiant DL385 Gen10 Server - update to 2.64_11-17-2022
HPE ProLiant DL325 Gen10 Server - update to 2.64_11-17-2022

• https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3001.html

• Multiple vulnerabilities in AMD server processors
• Multiple vulnerabilities in HPE ProLiant Gen10 and Gen10 Plus Servers
• Multiple vulnerabilities in Dell PowerEdge Server for AMD Server
• Multiple vulnerabilities in HPE Cray EX235a Accelerator Blade