Details of the most critical of the identified vulnerabilities;
The security vulnerability tracked as CVE-2021-26316 is a remote code execution vulnerability that affects AMD EPYC and Ryzen processors and is caused by incorrect validation of the communication buffer and communication service in the BIOS. An authenticated local threat actor could exploit this vulnerability to execute arbitrary code in SMM (System Management Mode) via a specially crafted request.
The vulnerabilities tracked as CVE-2021-26346 and CVE-2021-46795 have been identified as Denial of Service (DoS) bugs affecting Ryzen processors.
The security vulnerability tracked as CVE-2021-26402 affects AMD EPYC processors and is caused by insufficient bounds checking in ASP (AMD Secure Processor) firmware.
AMD has submitted these vulnerabilities to Original Equipment Manufacturers (OEMs) for remediation. Users of vulnerable AMD processors are advised to contact their respective OEM for a BIOS update specific to their product. An original product manufacturer (OEM) is a manufacturing company that produces parts, equipment, or other products for another company.
