CVE-2021-26314

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

Potential floating point value injection in all supported CPU products, in conjunction with software vulnerabilities relating to speculative execution with incorrect floating point results, may cause the use of incorrect data from FPVI and may result in data leakage.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-208 CWE-203

Affected software

Vendor	Product	Versions
AMD	All supported processors	>= unspecified, < undefined

References

http://www.openwall.com/lists/oss-security/2021/06/09/2Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/06/10/1Exploit, Mailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H36U6CNREC436W6GYO7QUMJIVEA35SCV/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SVA2NY26MMXOODUMYZN5DCU3FXMBMBOB/
https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1003Vendor Advisory
http://www.openwall.com/lists/oss-security/2021/06/09/2Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/06/10/1Exploit, Mailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H36U6CNREC436W6GYO7QUMJIVEA35SCV/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SVA2NY26MMXOODUMYZN5DCU3FXMBMBOB/
https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1003Vendor Advisory

Timeline

Published: Jun 9, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-263157.8When the AMD Platform Security Processor (PSP) boot rom loads, authenticates, and subsequently decrypts an encrypted FW, due to insufficient CVE-2021-263167.8Failure to validate the communication buffer and communication service in the BIOS may allow an attacker to tamper with the buffer resulting CVE-2021-263177.8Failure to verify the protocol in SMM may allow an attacker to control the protocol and modify SPI flash resulting in a potential arbitrary CVE-2021-263184.7A timing and power-based side channel attack leveraging the x86 PREFETCH instructions on some AMD CPUs could potentially result in leaked ke CVE-2021-263205.5Insufficient validation of the AMD SEV Signing Key (ASK) in the SEND_START command in the SEV Firmware may allow a local authenticated attac CVE-2021-263215.5Insufficient ID command validation in the SEV Firmware may allow a local authenticated attacker to perform a denial of service of the PSP.CVE-2021-263227.5Persistent platform private key may not be protected with a random IV leading to a potential “two time pad attack”.CVE-2021-263237.8Failure to validate SEV Commands while SNP is active may result in a potential impact to memory integrity.CVE-2021-263247.8A bug with the SEV-ES TMR may lead to a potential loss of memory integrity for SNP-active VMs.CVE-2021-263255.5Insufficient input validation in the SNP_GUEST_REQUEST command may lead to a potential data abort error and a denial of service.CVE-2021-263267.8Failure to validate VM_HSAVE_PA during SNP_INIT may result in a loss of memory integrity.CVE-2021-263275.5Insufficient validation of guest context in the SNP Firmware could lead to a potential loss of guest confidentiality.