Out-of-bounds write in AMD products - CVE-2021-26344

Vulnerability identifier: #VU97944

CSH Severity: Low

CVSS v4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-26344

CWE-ID: CWE-787

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error when processing the AMD PSP1 Configuration Block (APCB). A local user can trigger an out-of-bounds write, modify the APCB block and execute arbitrary code on the target system.

1st Gen AMD EPYC Processors
3rd Gen AMD EPYC Processors
2nd Gen AMD EPYC Processors
SimpliVity 325 Gen10 Plus
SimpliVity 325 Gen10
SimpliVity 325 Gen 11
HPE ProLiant DL345 Gen11 Server
HPE Gen11 BIOS
HPE ProLiant DL385 Gen11 Server
HPE ProLiant DL365 Gen11 Server
HPE ProLiant DL325 Gen11 Server
HPE ProLiant DL325 Gen10 Plus v2 server
HPE ProLiant DL345 Gen10 Plus server
HPE ProLiant DL365 Gen10 Plus server
HPE ProLiant DL385 Gen10 Plus server
HPE ProLiant DL385 Gen10 Plus v2 server
HPE ProLiant DL325 Gen10 Plus server
HPE Gen10 Plus BIOS
HPE ProLiant DL325 Gen10 Server
HPE ProLiant DL385 Gen10 Server
HPE Gen10 BIOS

Install updates from vendor's website.

3rd Gen AMD EPYC Processors - update to MilanPI 1.0.0.5
2nd Gen AMD EPYC Processors - update to RomePI 1.0.0.C
SimpliVity 325 Gen10 Plus - update to SVTSPGen10-2024_0731
SimpliVity 325 Gen10 - update to SVTSPGen10-2024_0731
SimpliVity 325 Gen 11 - update to SVTSPGen11-2024_0731
HPE ProLiant DL345 Gen11 Server - update to 1.58_01-04-2024
HPE Gen11 BIOS - update to 1.58_01-04-2024
HPE ProLiant DL385 Gen11 Server - update to 1.58_01-04-2024
HPE ProLiant DL365 Gen11 Server - update to 1.58_01-04-2024
HPE ProLiant DL325 Gen11 Server - update to 1.58_01-04-2024
HPE ProLiant DL325 Gen10 Plus v2 server - update to 2.84_08-17-2023
HPE ProLiant DL345 Gen10 Plus server - update to 2.84_08-17-2023
HPE ProLiant DL365 Gen10 Plus server - update to 2.84_08-17-2023
HPE ProLiant DL385 Gen10 Plus server - update to 2.84_08-17-2023
HPE ProLiant DL385 Gen10 Plus v2 server - update to 2.84_08-17-2023
HPE ProLiant DL325 Gen10 Plus server - update to 2.84_08-17-2023
HPE Gen10 Plus BIOS - update to 2.84_08-17-2023
HPE ProLiant DL325 Gen10 Server - update to 2.84_09-07-2023
HPE ProLiant DL385 Gen10 Server - update to 2.84_09-07-2023
HPE Gen10 BIOS - update to 2.84_09-07-2023

• https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3003.html

• Multiple vulnerabilities in AMD EPYC processors
• Multiple vulnerabilities in HPE ProLiant DL Servers with AMD EPYC processors
• HPE SimpliVity update for AMD EPYC firmware