CVE-2021-26370: Input Validation
Improper validation of destination address in SVCLOADFWIMAGEBYINSTANCE and SVCLOADBINARYBYATTRIB in a malicious UApp or ABL may allow an attacker to overwrite arbitrary bootloader memory with SPI ROM contents resulting in a loss of integrity and availability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-26370?
CVE-2021-26370 is classified as a medium severity vulnerability due to its potential to allow an attacker to overwrite arbitrary bootloader memory.
How do I fix CVE-2021-26370?
To fix CVE-2021-26370, update the affected AMD EPYC firmware to the latest version that is not vulnerable.
What products are affected by CVE-2021-26370?
CVE-2021-26370 affects multiple AMD EPYC firmware versions that are below milanpi-sp3_1.0.0.4.
What can an attacker achieve with CVE-2021-26370?
An attacker exploiting CVE-2021-26370 may achieve unauthorized access and modification of the bootloader memory, leading to a loss of system integrity and availability.
When was CVE-2021-26370 disclosed?
CVE-2021-26370 was publicly disclosed as part of AMD's Product Security Bulletin on October 2021.