Memory leak in AMD products - CVE-2021-26371
Published: May 10, 2023
Vulnerability identifier: #VU75981
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2021-26371
CWE-ID: CWE-401
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: AMD
Affected software:
1st Gen AMD EPYC Processors
2nd Gen AMD EPYC Processors
3rd Gen AMD EPYC Processors
1st Gen AMD EPYC Processors
2nd Gen AMD EPYC Processors
3rd Gen AMD EPYC Processors
Detailed vulnerability description
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due memory leak. A compromised or malicious ABL or UApp can send a SHA256 system call to the bootloader and expose ASP memory to userspace.
How to mitigate CVE-2021-26371
Install updates from vendor's website.