CVE-2021-26311

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

In the AMD SEV/SEV-ES feature, memory can be rearranged in the guest address space that is not detected by the attestation mechanism which could be used by a malicious hypervisor to potentially lead to arbitrary code execution within the guest VM if a malicious administrator has access to compromise the server hypervisor.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

Vendor	Product	Versions
AMD	SEV/SEV-ES	>= unspecified, < SEV-SNP

References

https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1004Vendor Advisory
https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1004Vendor Advisory

Timeline

Published: May 13, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-263125.5Failure to flush the Translation Lookaside Buffer (TLB) of the I/O memory management unit (IOMMU) may lead an IO device to write to memory i CVE-2021-263135.5Potential speculative code store bypass in all supported CPU products, in conjunction with software vulnerabilities relating to speculative CVE-2021-263145.5Potential floating point value injection in all supported CPU products, in conjunction with software vulnerabilities relating to speculative CVE-2021-263157.8When the AMD Platform Security Processor (PSP) boot rom loads, authenticates, and subsequently decrypts an encrypted FW, due to insufficient CVE-2021-263167.8Failure to validate the communication buffer and communication service in the BIOS may allow an attacker to tamper with the buffer resulting CVE-2021-263177.8Failure to verify the protocol in SMM may allow an attacker to control the protocol and modify SPI flash resulting in a potential arbitrary CVE-2021-263184.7A timing and power-based side channel attack leveraging the x86 PREFETCH instructions on some AMD CPUs could potentially result in leaked ke CVE-2021-263205.5Insufficient validation of the AMD SEV Signing Key (ASK) in the SEND_START command in the SEV Firmware may allow a local authenticated attac CVE-2021-263215.5Insufficient ID command validation in the SEV Firmware may allow a local authenticated attacker to perform a denial of service of the PSP.CVE-2021-263227.5Persistent platform private key may not be protected with a random IV leading to a potential “two time pad attack”.CVE-2021-263237.8Failure to validate SEV Commands while SNP is active may result in a potential impact to memory integrity.CVE-2021-263247.8A bug with the SEV-ES TMR may lead to a potential loss of memory integrity for SNP-active VMs.