Amd Ryzen Embedded V3000 Series Processors
Monthly
Insufficient granularity of access control in ASP (AMD Secure Processor) may allow an attacker with an untrusted user space application to map sensitive SMN (System Management Network) apertures. Rated high severity (CVSS 7.1). No vendor patch available.
Improper input validation in the System Management Mode (SMM) communications buffer could allow a privileged attacker to perform an out of bounds read or write to a limited section of the Top of. Rated medium severity (CVSS 4.6), this vulnerability is low attack complexity. No vendor patch available.
A compromised Trusted OS (TOS) driver could issue a malformed call that could potentially allow memory access outside the intended range resulting in loss of integrity. Rated low severity (CVSS 1.8). No vendor patch available.
Local privilege escalation in the AMD Platform Configuration Blob (APCB) SMM driver, shipped in AGESA firmware across nearly the entire modern AMD EPYC, Ryzen, Threadripper, and Instinct MI300 line, lets a Ring 0 attacker escalate into System Management Mode (SMM) and potentially run arbitrary code below the operating system. The flaw stems from the SMM driver improperly invoking UEFI boot services, and AMD-reported it with a CVSS 4.0 base of 7.1; there is no public exploit identified at time of analysis and EPSS is negligible at 0.01%. Because SMM code runs at a higher trust level than the OS kernel, successful exploitation can undermine firmware integrity and any SMM-based security guarantees.
Insufficient granularity of access control in ASP (AMD Secure Processor) may allow an attacker with an untrusted user space application to map sensitive SMN (System Management Network) apertures. Rated high severity (CVSS 7.1). No vendor patch available.
Improper input validation in the System Management Mode (SMM) communications buffer could allow a privileged attacker to perform an out of bounds read or write to a limited section of the Top of. Rated medium severity (CVSS 4.6), this vulnerability is low attack complexity. No vendor patch available.
A compromised Trusted OS (TOS) driver could issue a malformed call that could potentially allow memory access outside the intended range resulting in loss of integrity. Rated low severity (CVSS 1.8). No vendor patch available.
Local privilege escalation in the AMD Platform Configuration Blob (APCB) SMM driver, shipped in AGESA firmware across nearly the entire modern AMD EPYC, Ryzen, Threadripper, and Instinct MI300 line, lets a Ring 0 attacker escalate into System Management Mode (SMM) and potentially run arbitrary code below the operating system. The flaw stems from the SMM driver improperly invoking UEFI boot services, and AMD-reported it with a CVSS 4.0 base of 7.1; there is no public exploit identified at time of analysis and EPSS is negligible at 0.01%. Because SMM code runs at a higher trust level than the OS kernel, successful exploitation can undermine firmware integrity and any SMM-based security guarantees.