Romepi Firmware
by AMD
CVEs (6)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-20522 | Hig | 0.49 | 7.5 | 0.01 | Jan 11, 2023 | Insufficient input validation in ASP may allow an attacker with a malicious BIOS to potentially cause a denial of service. | ||
| CVE-2021-46779 | Hig | 0.46 | 7.1 | 0.00 | Jan 11, 2023 | Insufficient input validation in SVC_ECC_PRIMITIVE system call in a compromised user application or ABL may allow an attacker to corrupt ASP (AMD Secure Processor) OS memory which may lead to potential loss of integrity and availability. | ||
| CVE-2021-46767 | Med | 0.40 | 6.1 | 0.00 | Jan 11, 2023 | Insufficient input validation in the ASP may allow an attacker with physical access, unauthorized write access to memory potentially leading to a loss of integrity or denial of service. | ||
| CVE-2021-46768 | Med | 0.36 | 5.5 | 0.00 | Jan 11, 2023 | Insufficient input validation in SEV firmware may allow an attacker to perform out-of-bounds memory reads within the ASP boot loader, potentially leading to a denial of service. | ||
| CVE-2021-26407 | Med | 0.36 | 5.5 | 0.00 | Jan 11, 2023 | A randomly generated Initialization Vector (IV) may lead to a collision of IVs with the same key potentially resulting in information disclosure. | ||
| CVE-2022-23813 | Med | 0.34 | 5.3 | 0.01 | Jan 11, 2023 | The software interfaces to ASP and SMU may not enforce the SNP memory security policy resulting in a potential loss of integrity of guest memory in a confidential compute environment. |
- risk 0.49cvss 7.5epss 0.01
Insufficient input validation in ASP may allow an attacker with a malicious BIOS to potentially cause a denial of service.
- risk 0.46cvss 7.1epss 0.00
Insufficient input validation in SVC_ECC_PRIMITIVE system call in a compromised user application or ABL may allow an attacker to corrupt ASP (AMD Secure Processor) OS memory which may lead to potential loss of integrity and availability.
- risk 0.40cvss 6.1epss 0.00
Insufficient input validation in the ASP may allow an attacker with physical access, unauthorized write access to memory potentially leading to a loss of integrity or denial of service.
- risk 0.36cvss 5.5epss 0.00
Insufficient input validation in SEV firmware may allow an attacker to perform out-of-bounds memory reads within the ASP boot loader, potentially leading to a denial of service.
- risk 0.36cvss 5.5epss 0.00
A randomly generated Initialization Vector (IV) may lead to a collision of IVs with the same key potentially resulting in information disclosure.
- risk 0.34cvss 5.3epss 0.01
The software interfaces to ASP and SMU may not enforce the SNP memory security policy resulting in a potential loss of integrity of guest memory in a confidential compute environment.