5.7

CVE-2024-21981

Improper key usage control in AMD Secure Processor
(ASP) may allow an attacker with local access who has gained arbitrary code
execution privilege in ASP to
extract ASP cryptographic keys, potentially resulting in loss of
confidentiality and integrity.

Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD
This information is available to logged-in users.
Daten sind bereitgestellt durch das CVE Programm von Authorized Data Publishers (ADP) (Unstrukturiert)
Vendoramd
≫
Product athlon
Default Statusunknown
Version < *
Version 0
Status affected
Vendoramd
≫
Product ryzen
Default Statusunknown
Version < *
Version 0
Status affected
Vendoramd
≫
Product epyc
Default Statusunknown
Version < *
Version 0
Status affected
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.04% 0.093
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
psirt@amd.com 5.7 0.5 5.2
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
CWE-639 Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.