CVE-2021-26322: High severity amd epyc 7601 firmware vulnerability
Published Nov 16, 2021
·Updated
Persistent platform private key may not be protected with a random IV leading to a potential “two time pad attack”.
Affected Software
114 affected components
AMD Epyc 7601 Firmware<naplespi-sp3_1.0.0.g
AMD Epyc 7601
AMD Epyc 7551p Firmware<naplespi-sp3_1.0.0.g
AMD Epyc 7551p
AMD Epyc 7551 Firmware<naplespi-sp3_1.0.0.g
AMD Epyc 7551
AMD Epyc 7501 Firmware<naplespi-sp3_1.0.0.g
AMD Epyc 7501
AMD Epyc 7451 Firmware<naplespi-sp3_1.0.0.g
AMD Epyc 7451
AMD Epyc 7401 Firmware<naplespi-sp3_1.0.0.g
AMD Epyc 7401
AMD Epyc 7371 Firmware<naplespi-sp3_1.0.0.g
AMD Epyc 7371
AMD Epyc 7351p Firmware<naplespi-sp3_1.0.0.g
AMD Epyc 7351p
AMD Epyc 7351 Firmware<naplespi-sp3_1.0.0.g
AMD Epyc 7351
AMD Epyc 7301 Firmware<naplespi-sp3_1.0.0.g
AMD Epyc 7301
AMD Epyc 7281 Firmware<naplespi-sp3_1.0.0.g
AMD Epyc 7281
AMD Epyc 7261 Firmware<naplespi-sp3_1.0.0.g
AMD Epyc 7261
AMD Epyc 7251 Firmware<naplespi-sp3_1.0.0.g
AMD Epyc 7251
AMD Epyc 7f72 Firmware<romepi-sp3_1.0.0.c
AMD Epyc 7f72
AMD Epyc 7f52 Firmware<romepi-sp3_1.0.0.c
AMD Epyc 7f52
AMD Epyc 7f32 Firmware<romepi-sp3_1.0.0.c
AMD Epyc 7f32
AMD Epyc 7h12 Firmware<romepi-sp3_1.0.0.c
AMD Epyc 7h12
AMD Epyc 7742 Firmware<romepi-sp3_1.0.0.c
AMD Epyc 7742
AMD Epyc 7702 Firmware<romepi-sp3_1.0.0.c
AMD Epyc 7702
AMD Epyc 7702p Firmware<romepi-sp3_1.0.0.c
AMD Epyc 7702p
AMD Epyc 7662 Firmware<romepi-sp3_1.0.0.c
AMD Epyc 7662
AMD Epyc 7642 Firmware<romepi-sp3_1.0.0.c
AMD Epyc 7642
AMD Epyc 7552 Firmware<romepi-sp3_1.0.0.c
AMD Epyc 7552
AMD Epyc 7542 Firmware<romepi-sp3_1.0.0.c
AMD Epyc 7542
AMD Epyc 7532 Firmware<romepi-sp3_1.0.0.c
AMD Epyc 7532
AMD Epyc 7502 Firmware<romepi-sp3_1.0.0.c
AMD Epyc 7502
AMD Epyc 7502p Firmware<romepi-sp3_1.0.0.c
AMD Epyc 7502p
AMD Epyc 7452 Firmware<romepi-sp3_1.0.0.c
AMD Epyc 7452
AMD Epyc 7402 Firmware<romepi-sp3_1.0.0.c
AMD Epyc 7402
AMD Epyc 7402p Firmware<romepi-sp3_1.0.0.c
AMD Epyc 7402p
AMD Epyc 7352 Firmware<romepi-sp3_1.0.0.c
AMD Epyc 7352
AMD Epyc 7302 Firmware<romepi-sp3_1.0.0.c
AMD Epyc 7302
AMD Epyc 7302p Firmware<romepi-sp3_1.0.0.c
AMD Epyc 7302p
AMD Epyc 7282 Firmware<romepi-sp3_1.0.0.c
AMD Epyc 7282
AMD Epyc 7272 Firmware<romepi-sp3_1.0.0.c
AMD Epyc 7272
AMD Epyc 7262 Firmware<romepi-sp3_1.0.0.c
AMD Epyc 7262
AMD Epyc 7252 Firmware<romepi-sp3_1.0.0.c
AMD Epyc 7252
AMD Epyc 7232p Firmware<romepi-sp3_1.0.0.c
AMD Epyc 7232p
AMD Epyc 7763 Firmware<milanpi-sp3_1.0.0.4
AMD Epyc 7763
AMD Epyc 7713p Firmware<milanpi-sp3_1.0.0.4
AMD Epyc 7713p
AMD Epyc 7713 Firmware<milanpi-sp3_1.0.0.4
AMD Epyc 7713
AMD Epyc 7663 Firmware<milanpi-sp3_1.0.0.4
AMD Epyc 7663
AMD Epyc 7643 Firmware<milanpi-sp3_1.0.0.4
AMD Epyc 7643
AMD Epyc 75f3 Firmware<milanpi-sp3_1.0.0.4
AMD Epyc 75f3
AMD Epyc 7543p Firmware<milanpi-sp3_1.0.0.4
AMD Epyc 7543p
AMD Epyc 7543 Firmware<milanpi-sp3_1.0.0.4
AMD Epyc 7543
AMD Epyc 7513 Firmware<milanpi-sp3_1.0.0.4
AMD Epyc 7513
AMD Epyc 7453 Firmware<milanpi-sp3_1.0.0.4
AMD Epyc 7453
AMD Epyc 74f3 Firmware<milanpi-sp3_1.0.0.4
AMD Epyc 74f3
AMD Epyc 7443p Firmware<milanpi-sp3_1.0.0.4
AMD Epyc 7443p
AMD Epyc 7443 Firmware<milanpi-sp3_1.0.0.4
AMD Epyc 7443
AMD Epyc 7413 Firmware<milanpi-sp3_1.0.0.4
AMD Epyc 7413
AMD Epyc 73f3 Firmware<milanpi-sp3_1.0.0.4
AMD Epyc 73f3
AMD Epyc 7343 Firmware<milanpi-sp3_1.0.0.4
AMD Epyc 7343
AMD Epyc 7313p Firmware<milanpi-sp3_1.0.0.4
AMD Epyc 7313p
AMD Epyc 7313 Firmware<milanpi-sp3_1.0.0.4
AMD Epyc 7313
AMD Epyc 72f3 Firmware<milanpi-sp3_1.0.0.4
AMD Epyc 72f3
Event History
Nov 16, 2021
CVE Published
via MITRE·05:58 PM
Data Sourced
via MITRE·05:58 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2021-26322?
CVE-2021-26322 has a medium severity rating due to its potential for allowing a two time pad attack.
2
How do I fix CVE-2021-26322?
To fix CVE-2021-26322, update the affected AMD EPYC firmware to a version that includes a random IV protection.
3
Which AMD EPYC firmware versions are affected by CVE-2021-26322?
CVE-2021-26322 affects multiple AMD EPYC firmware versions up to and including naplespi-sp3_1.0.0.g.
4
What types of attacks could CVE-2021-26322 enable?
CVE-2021-26322 could enable a two time pad attack, compromising data confidentiality.
5
Is my AMD EPYC processor vulnerable to CVE-2021-26322?
If you are using an affected AMD EPYC firmware version below naplespi-sp3_1.0.0.g, your processor may be vulnerable.