What is the CVSS score of CVE-2021-26311?

CVE-2021-26311 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 1.7%.

Epyc 7232P CVE-2021-26311

HIGH

Command Injection (CWE-77)

2021-05-13 psirt@amd.com

Amd Command Injection RCE Epyc 7232P Epyc 7251 Epyc 7252 Epyc 7261 Epyc 7262 Epyc 7272 Epyc 7281 Epyc 7282 Epyc 72F3 Epyc 7301 Epyc 7302 Epyc 7302P Epyc 7313 Epyc 7313P Epyc 7343 Epyc 7351 Epyc 7351P Epyc 7352 Epyc 7371 Epyc 73F3 Epyc 7401 Epyc 7401P Epyc 7402 Epyc 7402P Epyc 7413 Epyc 7443 Epyc 7443P Epyc 7451 Epyc 7452 Epyc 7453 Epyc 74F3 Epyc 7501 Epyc 7502 Epyc 7502P Epyc 7513 Epyc 7532 Epyc 7542 Epyc 7543 Epyc 7543P Epyc 7551 Epyc 7551P Epyc 7552 Epyc 75F3 Epyc 7601 Epyc 7642 Epyc 7643 Epyc 7662 Epyc 7663 Epyc 7702 Epyc 7702P Epyc 7713 Epyc 7713P Epyc 7742 Epyc 7763 Epyc 7F32 Epyc 7F52 Epyc 7F72 Epyc 7H12 Epyc Embedded 3101 Epyc Embedded 3151 Epyc Embedded 3201 Epyc Embedded 3251 Epyc Embedded 3255 Epyc Embedded 3351 Epyc Embedded 3451

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

May 13, 2021 - 12:15 nvd

HIGH 7.2

DescriptionNVD

In the AMD SEV/SEV-ES feature, memory can be rearranged in the guest address space that is not detected by the attestation mechanism which could be used by a malicious hypervisor to potentially lead to arbitrary code execution within the guest VM if a malicious administrator has access to compromise the server hypervisor.

AnalysisAI

In the AMD SEV/SEV-ES feature, memory can be rearranged in the guest address space that is not detected by the attestation mechanism which could be used by a malicious hypervisor to potentially lead. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Command Injection (CWE-77), which allows attackers to inject arbitrary commands into system command execution. In the AMD SEV/SEV-ES feature, memory can be rearranged in the guest address space that is not detected by the attestation mechanism which could be used by a malicious hypervisor to potentially lead to arbitrary code execution within the guest VM if a malicious administrator has access to compromise the server hypervisor. Affected products include: Amd Epyc 7232P, Amd Epyc 7251, Amd Epyc 7252, Amd Epyc 7261, Amd Epyc 7262.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Use parameterized APIs, avoid shell execution, validate input with strict allowlists.