CVE-2024-21981

Published: Aug 13, 2024

Modified: Aug 15, 2024

PUBLISHED

CVSS v3.1

5.7

MEDIUM

Description

Improper key usage control in AMD Secure Processor (ASP) may allow an attacker with local access who has gained arbitrary code execution privilege in ASP to extract ASP cryptographic keys, potentially resulting in loss of confidentiality and integrity.

Vendor	Product	Versions
AMD	AMD EPYC™ 7001 Series Processors	affected `various`
AMD	AMD EPYC™ 7002 Series Processors	affected `various`
AMD	AMD EPYC™ 7003 Series Processors	affected `various`
AMD	AMD Ryzen™ 3000 Series Desktop Processors	affected `various`
AMD	AMD Ryzen™ 5000 Series Desktop Processors	affected `various`
AMD	AMD Ryzen™ 5000 Series Desktop Processor with Radeon™ Graphics	affected `various`
AMD	AMD Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics	affected `various`
AMD	AMD Ryzen™ 4000 Series Desktop Processors with Radeon™ Graphics	affected `various`
AMD	AMD Ryzen™ Threadripper™ 3000 Series Processors	affected `various`
AMD	AMD Ryzen™ Threadripper™ PRO 3000WX Series Processors	affected `various`
AMD	AMD Ryzen™ Threadripper™ PRO 5000WX Processors	affected `various`
AMD	AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics	affected `various`
AMD	AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics	affected `various`
AMD	AMD Ryzen™ 3000 Series Mobile Processor with Radeon™ Graphics	affected `various`
AMD	AMD EPYC™ Embedded 3000 Series Processors	affected `various`
AMD	AMD EPYC™ Embedded 7002 Series Processors	affected `various`
AMD	AMD EPYC™ Embedded 7003 Series Processors	affected `various`
AMD	AMD Ryzen™ Embedded R1000 Series Processors	affected `various`
AMD	AMD Ryzen™ Embedded R2000 Series Processors	affected `various`
AMD	AMD Ryzen™ Embedded 5000 Series Processors	affected `various`
AMD	AMD Ryzen™ Embedded V1000 Series Processors	affected `various`

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Local

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

References

https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3003.html

vendor-advisory

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now

CVE-2024-21981

Description

Affected Products

CVSS v3.1 Details

References