CVE-2021-26398
Severity CVSS v4.0:
Pending analysis
Type:
CWE-787
Out-of-bounds Write
Publication date:
11/01/2023
Last modified:
09/04/2025
Description
Insufficient input validation in SYS_KEY_DERIVE system call in a compromised user application or ABL may allow an attacker to corrupt ASP (AMD Secure Processor) OS memory which may lead to potential arbitrary code execution.<br />
<br />
Impact
Base Score 3.x
7.80
Severity 3.x
HIGH
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:amd:epyc_7h12_firmware:*:*:*:*:*:*:*:* | romepi_1.0.0.c (excluding) | |
| cpe:2.3:h:amd:epyc_7h12:-:*:*:*:*:*:*:* | ||
| cpe:2.3:o:amd:epyc_7f72_firmware:*:*:*:*:*:*:*:* | romepi_1.0.0.c (excluding) | |
| cpe:2.3:h:amd:epyc_7f72:-:*:*:*:*:*:*:* | ||
| cpe:2.3:o:amd:epyc_7f52_firmware:*:*:*:*:*:*:*:* | romepi_1.0.0.c (excluding) | |
| cpe:2.3:h:amd:epyc_7f52:-:*:*:*:*:*:*:* | ||
| cpe:2.3:o:amd:epyc_7f32_firmware:*:*:*:*:*:*:*:* | romepi_1.0.0.c (excluding) | |
| cpe:2.3:h:amd:epyc_7f32:-:*:*:*:*:*:*:* | ||
| cpe:2.3:o:amd:epyc_7742_firmware:*:*:*:*:*:*:*:* | romepi_1.0.0.c (excluding) | |
| cpe:2.3:h:amd:epyc_7742:-:*:*:*:*:*:*:* | ||
| cpe:2.3:o:amd:epyc_7702p_firmware:*:*:*:*:*:*:*:* | romepi_1.0.0.c (excluding) | |
| cpe:2.3:h:amd:epyc_7702p:-:*:*:*:*:*:*:* | ||
| cpe:2.3:o:amd:epyc_7702_firmware:*:*:*:*:*:*:*:* | romepi_1.0.0.c (excluding) | |
| cpe:2.3:h:amd:epyc_7702:-:*:*:*:*:*:*:* | ||
| cpe:2.3:o:amd:epyc_7662_firmware:*:*:*:*:*:*:*:* | romepi_1.0.0.c (excluding) |
To consult the complete list of CPE names with products and versions, see this page