CVE-2021-46771

HIGH

AMD EPYC Milan Firmware < milanpi-sp3_1.0.0.4 - Arbitrary Code Execution via ASP System Call

Title source: llm

Description

Insufficient validation of addresses in AMD Secure Processor (ASP) firmware system call may potentially lead to arbitrary code execution by a compromised user application.

References (1)

Core 1

Core References

Vendor Advisory x_refsource_misc

https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1021

Scores

CVSS v3 7.8

EPSS 0.0010

EPSS Percentile 27.8%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-20

Status published

Products (23)

amd/epyc_72f3_firmware < milanpi-sp3_1.0.0.4

amd/epyc_7313_firmware < milanpi-sp3_1.0.0.4

amd/epyc_7313p_firmware < milanpi-sp3_1.0.0.4

amd/epyc_7343_firmware < milanpi-sp3_1.0.0.4

amd/epyc_7373x_firmware < milanpi-sp3_1.0.0.4

amd/epyc_73f3_firmware < milanpi-sp3_1.0.0.4

amd/epyc_7413_firmware < milanpi-sp3_1.0.0.4

amd/epyc_7443_firmware < milanpi-sp3_1.0.0.4

amd/epyc_7443p_firmware < milanpi-sp3_1.0.0.4

amd/epyc_7453_firmware < milanpi-sp3_1.0.0.4

... and 13 more

Published May 10, 2022

Tracked Since Feb 18, 2026