CVE-2021-26401: Medium severity AMD Athlon X4 940 Firmware vulnerability
A flaw was found in hw. The speculative execution window of AMD LFENCE/JMP mitigation (MITIGATION V2-2) may be large enough to be exploited on AMD CPUs.
Other sources
LFENCE/JMP (mitigation V2-2) may not sufficiently mitigate CVE-2017-5715 on some AMD CPUs.
The speculative execution window of AMD LFENCE/JMP mitigation (MITIGATION V2-2) may be large enough to be exploited on AMD CPUs.
An Intel PoC (proof of concept) demonstrates that the speculative execution window for an incorrect indirect branch prediction using an LFENCE/JMP sequence may potentially be large enough to allow exploitation using CVE-2017-5715. This was observed on AMD CPUs codenamed “Zen”, “Zen+”, “Zen 2”, and “Zen 3” using a specific workload on a Simultaneous Multi-Threading (SMT) sibling thread.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:2.6.32-754.49.1.el6 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:3.10.0-1160.83.1.rt56.1228.el7 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:3.10.0-1160.83.1.el7 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-372.9.1.rt7.166.el8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-372.9.1.el8 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 4.4.0-1117.123 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 4.15.0-1138.151~14.04.1 - Upgrade
Upgrade
ubuntu/linux-lts-xenialto a version that resolves this vulnerability.Fixed in 4.4.0-239.273~14.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 4.4.0-239.273 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 4.4.0-1155.170 - Upgrade
Upgrade
ubuntu/linux-aws-hweto a version that resolves this vulnerability.Fixed in 4.15.0-1128.137~16.04.1 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 4.15.0-1138.151~16.04.1 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 4.15.0-1122.136~16.04.1 - Upgrade
Upgrade
ubuntu/linux-hweto a version that resolves this vulnerability.Fixed in 4.15.0-177.186~16.04.1 - Upgrade
Upgrade
ubuntu/linux-kvmto a version that resolves this vulnerability.Fixed in 4.4.0-1118.128 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 4.15.0-1093.102~16.04.1 - Upgrade
Upgrade
ubuntu/linux-fipsto a version that resolves this vulnerability.Fixed in 4.4.0-1088.95 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 4.15.0-177.186 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 4.15.0-1128.137 - Upgrade
Upgrade
ubuntu/linux-aws-5.4to a version that resolves this vulnerability.Fixed in 5.4.0-1075.80~18.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-4.15to a version that resolves this vulnerability.Fixed in 4.15.0-1138.151 - Upgrade
Upgrade
ubuntu/linux-azure-5.4to a version that resolves this vulnerability.Fixed in 5.4.0-1078.81~18.04.1 - Upgrade
Upgrade
ubuntu/linux-dell300xto a version that resolves this vulnerability.Fixed in 4.15.0-1042.47 - Upgrade
Upgrade
ubuntu/linux-gcp-4.15to a version that resolves this vulnerability.Fixed in 4.15.0-1122.136 - Upgrade
Upgrade
ubuntu/linux-gcp-5.4to a version that resolves this vulnerability.Fixed in 5.4.0-1073.78~18.04.1 - Upgrade
Upgrade
ubuntu/linux-gke-5.4to a version that resolves this vulnerability.Fixed in 5.4.0-1071.76~18.04.3 - Upgrade
Upgrade
ubuntu/linux-gkeop-5.4to a version that resolves this vulnerability.Fixed in 5.4.0-1040.41~18.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-5.4to a version that resolves this vulnerability.Fixed in 5.4.0-110.124~18.04.1 - Upgrade
Upgrade
ubuntu/linux-ibm-5.4to a version that resolves this vulnerability.Fixed in 5.4.0-1021.23~18.04.1 - Upgrade
Upgrade
ubuntu/linux-kvmto a version that resolves this vulnerability.Fixed in 4.15.0-1114.117 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 4.15.0-1093.102 - Upgrade
Upgrade
ubuntu/linux-oracle-5.4to a version that resolves this vulnerability.Fixed in 5.4.0-1071.77~18.04.1 - Upgrade
Upgrade
ubuntu/linux-raspi-5.4to a version that resolves this vulnerability.Fixed in 5.4.0-1060.68~18.04.1 - Upgrade
Upgrade
ubuntu/linux-raspi2to a version that resolves this vulnerability.Fixed in 4.15.0-1109.116 - Upgrade
Upgrade
ubuntu/linux-snapdragonto a version that resolves this vulnerability.Fixed in 4.15.0-1127.136 - Upgrade
Upgrade
ubuntu/linux-aws-fipsto a version that resolves this vulnerability.Fixed in 4.15.0-2067.70 - Upgrade
Upgrade
ubuntu/linux-azure-fipsto a version that resolves this vulnerability.Fixed in 4.15.0-2049.53 - Upgrade
Upgrade
ubuntu/linux-fipsto a version that resolves this vulnerability.Fixed in 4.15.0-1085.94 - Upgrade
Upgrade
ubuntu/linux-gcp-fipsto a version that resolves this vulnerability.Fixed in 4.15.0-2032.35 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 5.4.0-110.124 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 5.4.0-1073.78 - Upgrade
Upgrade
ubuntu/linux-aws-5.13to a version that resolves this vulnerability.Fixed in 5.13.0-1023.25~20.04.1 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 5.4.0-1078.81 - Upgrade
Upgrade
ubuntu/linux-azure-5.13to a version that resolves this vulnerability.Fixed in 5.13.0-1023.27~20.04.1 - Upgrade
Upgrade
ubuntu/linux-bluefieldto a version that resolves this vulnerability.Fixed in 5.4.0-1040.44 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 5.4.0-1073.78 - Upgrade
Upgrade
ubuntu/linux-gcp-5.13to a version that resolves this vulnerability.Fixed in 5.13.0-1025.30~20.04.1 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 5.4.0-1071.76 - Upgrade
Upgrade
ubuntu/linux-gkeopto a version that resolves this vulnerability.Fixed in 5.4.0-1040.41 - Upgrade
Upgrade
ubuntu/linux-hwe-5.13to a version that resolves this vulnerability.Fixed in 5.13.0-41.46~20.04.1 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 5.4.0-1021.23 - Upgrade
Upgrade
ubuntu/linux-intel-iotg-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1008.11~20.04.1 - Upgrade
Upgrade
ubuntu/linux-iotto a version that resolves this vulnerability.Fixed in 5.4.0-1004.6 - Upgrade
Upgrade
ubuntu/linux-kvmto a version that resolves this vulnerability.Fixed in 5.4.0-1063.66 - Upgrade
Upgrade
ubuntu/linux-oem-5.14to a version that resolves this vulnerability.Fixed in 5.14.0-1033.36 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 5.4.0-1071.77 - Upgrade
Upgrade
ubuntu/linux-oracle-5.13to a version that resolves this vulnerability.Fixed in 5.13.0-1028.33~20.04.1 - Upgrade
Upgrade
ubuntu/linux-raspito a version that resolves this vulnerability.Fixed in 5.4.0-1060.68 - Upgrade
Upgrade
ubuntu/linux-aws-fipsto a version that resolves this vulnerability.Fixed in 5.4.0-1073.78+fips1 - Upgrade
Upgrade
ubuntu/linux-azure-fipsto a version that resolves this vulnerability.Fixed in 5.4.0-1078.81+fips1 - Upgrade
Upgrade
ubuntu/linux-fipsto a version that resolves this vulnerability.Fixed in 5.4.0-1049.55 - Upgrade
Upgrade
ubuntu/linux-gcp-fipsto a version that resolves this vulnerability.Fixed in 5.4.0-1073.78+fips1 - Compensating control
Use generic retpoline instead of the LFENCE/JMP (Mitigation V2-2) sequence to mitigate CVE-2017-5715 on affected AMD CPUs.
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2021-26401?
CVE-2021-26401 is considered to have medium severity due to potential exploitation in certain AMD CPUs.
How can I fix CVE-2021-26401?
To remediate CVE-2021-26401, you should update your system to the latest kernel versions provided by your vendor that address the flaw.
Which AMD CPUs are affected by CVE-2021-26401?
CVE-2021-26401 impacts various AMD CPUs, particularly those utilizing specific versions of the LFENCE/JMP mitigation.
Are there any available patches for CVE-2021-26401?
Yes, patches for CVE-2021-26401 have been released for certain kernel versions by multiple vendors.
What implications does CVE-2021-26401 have for system security?
CVE-2021-26401 could allow malicious users to exploit speculative execution vulnerabilities to gain unauthorized access to sensitive information.