CVE-2021-26316

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Failure to validate the communication buffer and communication service in the BIOS may allow an attacker to tamper with the buffer resulting in potential SMM (System Management Mode) arbitrary code execution.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published: Jan 11, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-263177.8Failure to verify the protocol in SMM may allow an attacker to control the protocol and modify SPI flash resulting in a potential arbitrary CVE-2021-263184.7A timing and power-based side channel attack leveraging the x86 PREFETCH instructions on some AMD CPUs could potentially result in leaked ke CVE-2021-263205.5Insufficient validation of the AMD SEV Signing Key (ASK) in the SEND_START command in the SEV Firmware may allow a local authenticated attac CVE-2021-263215.5Insufficient ID command validation in the SEV Firmware may allow a local authenticated attacker to perform a denial of service of the PSP.CVE-2021-263227.5Persistent platform private key may not be protected with a random IV leading to a potential “two time pad attack”.CVE-2021-263237.8Failure to validate SEV Commands while SNP is active may result in a potential impact to memory integrity.CVE-2021-263247.8A bug with the SEV-ES TMR may lead to a potential loss of memory integrity for SNP-active VMs.CVE-2021-263255.5Insufficient input validation in the SNP_GUEST_REQUEST command may lead to a potential data abort error and a denial of service.CVE-2021-263267.8Failure to validate VM_HSAVE_PA during SNP_INIT may result in a loss of memory integrity.CVE-2021-263275.5Insufficient validation of guest context in the SNP Firmware could lead to a potential loss of guest confidentiality.CVE-2021-263284.4Failure to verify the mode of CPU execution at the time of SNP_INIT may lead to a potential loss of memory integrity for SNP guests.CVE-2021-263295.5AMD System Management Unit (SMU) may experience an integer overflow when an invalid length is provided which may result in a potential loss