CVE-2021-26311

high-risk
Published 2021-05-13

In the AMD SEV/SEV-ES feature, memory can be rearranged in the guest address space that is not detected by the attestation mechanism which could be used by a malicious hypervisor to potentially lead to arbitrary code execution within the guest VM if a malicious administrator has access to compromise the server hypervisor.

Do I need to act?

~
1.3% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.2/10 High
NETWORK / LOW complexity

Affected Products (20)

Epyc 7232P
Epyc 7251
Epyc 7252
Epyc 7261
Epyc 7262
Epyc 7272
Epyc 7281
Epyc 7282
Epyc 72F3
Epyc 7301
Epyc 7302
Epyc 7302P
Epyc 7313
Epyc 7313P
Epyc 7343
Epyc 7351
Epyc 7351P
Epyc 7352
Epyc 7371
Epyc 73F3

Affected Vendors

Amd

References (2)

Vendor Advisory https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1004
Vendor Advisory https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1004
57
/ 100
high-risk
Severity 26/34 · High
Exploitability 4/34 · Minimal
Exposure 27/34 · High