9
CVE-2021-26311
- EPSS 1.28%
- Published 13.05.2021 12:15:07
- Last modified 21.11.2024 05:56:04
- Source psirt@amd.com
- Teams watchlist Login
- Open Login
In the AMD SEV/SEV-ES feature, memory can be rearranged in the guest address space that is not detected by the attestation mechanism which could be used by a malicious hypervisor to potentially lead to arbitrary code execution within the guest VM if a malicious administrator has access to compromise the server hypervisor.
Data is provided by the National Vulnerability Database (NVD)
Amd ≫ Epyc 7232p Version-
Amd ≫ Epyc 7302p Version-
Amd ≫ Epyc 7313p Version-
Amd ≫ Epyc 7351p Version-
Amd ≫ Epyc 7401p Version-
Amd ≫ Epyc 7402p Version-
Amd ≫ Epyc 7443p Version-
Amd ≫ Epyc 7502p Version-
Amd ≫ Epyc 7543p Version-
Amd ≫ Epyc 7551p Version-
Amd ≫ Epyc 7702p Version-
Amd ≫ Epyc 7713p Version-
Amd ≫ Epyc Embedded 3101 Version-
Amd ≫ Epyc Embedded 3151 Version-
Amd ≫ Epyc Embedded 3201 Version-
Amd ≫ Epyc Embedded 3251 Version-
Amd ≫ Epyc Embedded 3255 Version-
Amd ≫ Epyc Embedded 3351 Version-
Amd ≫ Epyc Embedded 3451 Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 1.28% | 0.787 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 7.2 | 1.2 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
|
| nvd@nist.gov | 9 | 8 | 10 |
AV:N/AC:L/Au:S/C:C/I:C/A:C
|
CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.