Amperecomputing
Monthly
An out-of-bounds write in the UEFI-MM Secure Partition of Ampere AmpereOne platform firmware can be triggered by a malformed SMC (Secure Monitor Call) issued to the MMCommunicate service, allowing memory corruption inside the secure partition context on affected devices running firmware earlier than AC03 3.5.9.3, AC04 4.4.5.2, or AmpereOne M 5.4.5.1. Although the NVD-published CVSS 3.1 vector scores this 9.8 with AV:N/PR:N, that rating does not match the attack surface: the MMCommunicate SMC interface is a local, privileged interface, and our independent assessment reassesses the flaw as CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, meaning an attacker must already hold OS kernel/EL1-level execution on the host before reaching the vulnerable code. There is no indication of active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, so real-world risk is gated behind a prior operating-system compromise rather than direct remote reachability. Full technical details and fixed firmware versions are published by the vendor in advisory AMP-SB-0007.
An out-of-bounds write in the UEFI-MM PCIe driver of Ampere AmpereOne server firmware lets code that already holds kernel- or hypervisor-level control (EL1 and above on AArch64) corrupt memory inside the driver's S-EL0 secure-partition address space by issuing a malformed SMC call. Only systems running AmpereOne AC03 firmware below 3.5.9.3, AC04 below 4.4.5.2, or AmpereOne M below 5.4.5.1 are affected. Although the input scores this 9.8 with a AV:N/PR:N vector, the SMC instruction is privileged and cannot be reached by an unauthenticated remote user; the practical precondition is pre-existing privileged execution on the host (assessed CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). No public exploit code has been identified at time of analysis, and it is not listed in CISA KEV; vendor firmware fixes are available.
Ampere Altra and Ampere Altra Max devices through 2022-07-15 allow attacks via Hertzbleed, which is a power side-channel attack that extracts secret information from the CPU by correlating the power. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Ampere Altra devices before 1.08g and Ampere Altra Max devices before 2.05a allow attackers to control the predictions for return addresses and potentially hijack code flow to execute arbitrary code. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
On Ampere Altra and AltraMax devices before SRP 1.09, the Altra reference design of UEFI accesses allows insecure access to SPI-NOR by the OS/hypervisor component. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Spectre BHB is a variant of Spectre-v2 in which malicious code uses the shared branch history (stored in the CPU BHB) to influence mispredicted branches in the victim's hardware context. Rated medium severity (CVSS 4.7).
An out-of-bounds write in the UEFI-MM Secure Partition of Ampere AmpereOne platform firmware can be triggered by a malformed SMC (Secure Monitor Call) issued to the MMCommunicate service, allowing memory corruption inside the secure partition context on affected devices running firmware earlier than AC03 3.5.9.3, AC04 4.4.5.2, or AmpereOne M 5.4.5.1. Although the NVD-published CVSS 3.1 vector scores this 9.8 with AV:N/PR:N, that rating does not match the attack surface: the MMCommunicate SMC interface is a local, privileged interface, and our independent assessment reassesses the flaw as CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, meaning an attacker must already hold OS kernel/EL1-level execution on the host before reaching the vulnerable code. There is no indication of active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, so real-world risk is gated behind a prior operating-system compromise rather than direct remote reachability. Full technical details and fixed firmware versions are published by the vendor in advisory AMP-SB-0007.
An out-of-bounds write in the UEFI-MM PCIe driver of Ampere AmpereOne server firmware lets code that already holds kernel- or hypervisor-level control (EL1 and above on AArch64) corrupt memory inside the driver's S-EL0 secure-partition address space by issuing a malformed SMC call. Only systems running AmpereOne AC03 firmware below 3.5.9.3, AC04 below 4.4.5.2, or AmpereOne M below 5.4.5.1 are affected. Although the input scores this 9.8 with a AV:N/PR:N vector, the SMC instruction is privileged and cannot be reached by an unauthenticated remote user; the practical precondition is pre-existing privileged execution on the host (assessed CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). No public exploit code has been identified at time of analysis, and it is not listed in CISA KEV; vendor firmware fixes are available.
Ampere Altra and Ampere Altra Max devices through 2022-07-15 allow attacks via Hertzbleed, which is a power side-channel attack that extracts secret information from the CPU by correlating the power. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Ampere Altra devices before 1.08g and Ampere Altra Max devices before 2.05a allow attackers to control the predictions for return addresses and potentially hijack code flow to execute arbitrary code. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
On Ampere Altra and AltraMax devices before SRP 1.09, the Altra reference design of UEFI accesses allows insecure access to SPI-NOR by the OS/hypervisor component. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Spectre BHB is a variant of Spectre-v2 in which malicious code uses the shared branch history (stored in the CPU BHB) to influence mispredicted branches in the victim's hardware context. Rated medium severity (CVSS 4.7).