CVE-2021-26317

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Failure to verify the protocol in SMM may allow an attacker to control the protocol and modify SPI flash resulting in a potential arbitrary code execution.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published: May 12, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-263184.7A timing and power-based side channel attack leveraging the x86 PREFETCH instructions on some AMD CPUs could potentially result in leaked ke CVE-2021-263205.5Insufficient validation of the AMD SEV Signing Key (ASK) in the SEND_START command in the SEV Firmware may allow a local authenticated attac CVE-2021-263215.5Insufficient ID command validation in the SEV Firmware may allow a local authenticated attacker to perform a denial of service of the PSP.CVE-2021-263227.5Persistent platform private key may not be protected with a random IV leading to a potential “two time pad attack”.CVE-2021-263237.8Failure to validate SEV Commands while SNP is active may result in a potential impact to memory integrity.CVE-2021-263247.8A bug with the SEV-ES TMR may lead to a potential loss of memory integrity for SNP-active VMs.CVE-2021-263255.5Insufficient input validation in the SNP_GUEST_REQUEST command may lead to a potential data abort error and a denial of service.CVE-2021-263267.8Failure to validate VM_HSAVE_PA during SNP_INIT may result in a loss of memory integrity.CVE-2021-263275.5Insufficient validation of guest context in the SNP Firmware could lead to a potential loss of guest confidentiality.CVE-2021-263284.4Failure to verify the mode of CPU execution at the time of SNP_INIT may lead to a potential loss of memory integrity for SNP guests.CVE-2021-263295.5AMD System Management Unit (SMU) may experience an integer overflow when an invalid length is provided which may result in a potential loss CVE-2021-263305.5AMD System Management Unit (SMU) may experience a heap-based overflow which may result in a loss of resources.