CVE-2020-12926

MediumCVSS 6.4/10Last modified Jun 17, 2026

Description

The Trusted Platform Modules (TPM) reference software may not properly track the number of times a failed shutdown happens. This can leave the TPM in a state where confidential key material in the TPM may be able to be compromised. AMD believes that the attack requires physical access of the device because the power must be repeatedly turned on and off. This potential attack may be used to change confidential information, alter executables signed by key material in the TPM, or create a denial of service of the device.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-367

Affected software

No affected versions have been published.

Timeline

Published: Nov 12, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-129277.8A potential vulnerability in a dynamically loaded AMD driver in AMD VBIOS Flash Tool SDK may allow any authenticated user to escalate privil CVE-2020-129287.8A vulnerability in a dynamically loaded AMD driver in AMD Ryzen Master V15 may allow any authenticated user to escalate privileges to NT aut CVE-2020-129297.8Improper parameters validation in some trusted applications of the PSP contained in the AMD Graphics Driver may allow a local attacker to by CVE-2020-12937.8An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector Service improperly handles file operations, aka 'CVE-2020-129307.8Improper parameters handling in AMD Secure Processor (ASP) drivers may allow a privileged attacker to elevate their privileges potentially l CVE-2020-129317.8Improper parameters handling in the AMD Secure Processor (ASP) kernel may allow a privileged attacker to elevate their privileges potentiall CVE-2020-129335.5A denial of service vulnerability exists in the D3DKMTEscape handler functionality of AMD ATIKMDAG.SYS (e.g. version 26.20.15029.27017). A s CVE-2020-12947.8An elevation of privilege vulnerability exists in the way that the Windows WalletService handles objects in memory, aka 'Windows WalletServi CVE-2020-129447.8Insufficient validation of BIOS image length by ASP Firmware could lead to arbitrary code execution.CVE-2020-129467.1Insufficient input validation in ASP firmware for discrete TPM commands could allow a potential loss of integrity and denial of service.CVE-2020-12958.8An elevation of privilege vulnerability exists in Microsoft SharePoint, aka 'Microsoft SharePoint Elevation of Privilege Vulnerability'.CVE-2020-129517.0Race condition in ASP firmware could allow less privileged x86 code to perform ASP SMM (System Management Mode) operations.