What is CVE-2021-26315?

CVE-2021-26315 is a vulnerability in the AMD Platform Security Processor (PSP) boot rom that allows arbitrary code execution when encrypted firmware images are used.

What software versions are affected by CVE-2021-26315?

The affected software versions are AMD Epyc 7003 Firmware (up to exclusive version milanpi-sp3_1.0.0.4) and AMD Epyc 72f3, 7313, 7313p, 7343, 73f3, 7413, 7443, 7443p, 7453, 74f3, 7513, 7543, 7543p, 75f3, 7643, 7663, 7713, 7713p, and 7763 Firmware (up to exclusive version milanpi-sp3_1.0.0.4).

What is the severity of CVE-2021-26315?

The severity of CVE-2021-26315 is high with a CVSS score of 7.8.

How can I fix CVE-2021-26315?

To fix CVE-2021-26315, it is recommended to update to the latest firmware version provided by AMD.

Where can I find more information about CVE-2021-26315?

You can find more information about CVE-2021-26315 on the AMD Product Security Bulletin at https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1021.

Vulnerability/
CVE-2021-26315

high

7.8

CWE

345

16/11/2021

17/9/2024

CVE-2021-26315

First published: Tue Nov 16 2021(Updated: )

When the AMD Platform Security Processor (PSP) boot rom loads, authenticates, and subsequently decrypts an encrypted FW, due to insufficient verification of the integrity of decrypted image, arbitrary code may be executed in the PSP when encrypted firmware images are used.

Credit: psirt@amd.com

Affected Software	Affected Version	How to fix
Amd Epyc 7003 Firmware	<milanpi-sp3_1.0.0.4
Amd Epyc 7003
Amd Epyc 72f3 Firmware	<milanpi-sp3_1.0.0.4
Amd Epyc 72f3
Amd Epyc 7313 Firmware	<milanpi-sp3_1.0.0.4
Amd Epyc 7313
Amd Epyc 7313p Firmware	<milanpi-sp3_1.0.0.4
Amd Epyc 7313p
Amd Epyc 7343 Firmware	<milanpi-sp3_1.0.0.4
Amd Epyc 7343
Amd Epyc 73f3 Firmware	<milanpi-sp3_1.0.0.4
Amd Epyc 73f3
Amd Epyc 7413 Firmware	<milanpi-sp3_1.0.0.4
Amd Epyc 7413
Amd Epyc 7443 Firmware	<milanpi-sp3_1.0.0.4
Amd Epyc 7443
Amd Epyc 7443p Firmware	<milanpi-sp3_1.0.0.4
Amd Epyc 7443p
Amd Epyc 7453 Firmware	<milanpi-sp3_1.0.0.4
Amd Epyc 7453
Amd Epyc 74f3 Firmware	<milanpi-sp3_1.0.0.4
Amd Epyc 74f3
Amd Epyc 7513 Firmware	<milanpi-sp3_1.0.0.4
Amd Epyc 7513
Amd Epyc 7543 Firmware	<milanpi-sp3_1.0.0.4
Amd Epyc 7543
Amd Epyc 7543p Firmware	<milanpi-sp3_1.0.0.4
Amd Epyc 7543p
Amd Epyc 75f3 Firmware	<milanpi-sp3_1.0.0.4
Amd Epyc 75f3
Amd Epyc 7643 Firmware	<milanpi-sp3_1.0.0.4
Amd Epyc 7643
Amd Epyc 7663 Firmware	<milanpi-sp3_1.0.0.4
Amd Epyc 7663
Amd Epyc 7713 Firmware	<milanpi-sp3_1.0.0.4
Amd Epyc 7713
Amd Epyc 7713p Firmware	<milanpi-sp3_1.0.0.4
Amd Epyc 7713p
Amd Epyc 7763 Firmware	<milanpi-sp3_1.0.0.4
Amd Epyc 7763

Never miss a vulnerability like this again

Reference Links

https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1021

Frequently Asked Questions

What is CVE-2021-26315?
CVE-2021-26315 is a vulnerability in the AMD Platform Security Processor (PSP) boot rom that allows arbitrary code execution when encrypted firmware images are used.
What software versions are affected by CVE-2021-26315?
The affected software versions are AMD Epyc 7003 Firmware (up to exclusive version milanpi-sp3_1.0.0.4) and AMD Epyc 72f3, 7313, 7313p, 7343, 73f3, 7413, 7443, 7443p, 7453, 74f3, 7513, 7543, 7543p, 75f3, 7643, 7663, 7713, 7713p, and 7763 Firmware (up to exclusive version milanpi-sp3_1.0.0.4).
What is the severity of CVE-2021-26315?
The severity of CVE-2021-26315 is high with a CVSS score of 7.8.
How can I fix CVE-2021-26315?
To fix CVE-2021-26315, it is recommended to update to the latest firmware version provided by AMD.
Where can I find more information about CVE-2021-26315?
You can find more information about CVE-2021-26315 on the AMD Product Security Bulletin at https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1021.