Improper input validation in AMD 1st Gen AMD EPYC™
Priority LOW 34CWE-20Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
AMD System Management Unit (SMU) contains a potential issue where a malicious user may be able to manipulate mailbox entries leading to arbitrary code execution.
Why it matters now
EPSS 0.00295 22nd percentileScored 2026-11-07
Fix Fixed 1st Gen AMD EPYC™ (AMD): NaplesPI-SP3_1.0.0.G2nd Gen AMD EPYC™ (AMD): RomePI-SP3_1.0.0.C+1 more product
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| AMD | 1st Gen AMD EPYC™ | before NaplesPI-SP3_1.0.0.G | NaplesPI-SP3_1.0.0.G | Patch available | CNA |
| AMD | 2nd Gen AMD EPYC™ | before RomePI-SP3_1.0.0.C | RomePI-SP3_1.0.0.C | Patch available | CNA |
| AMD | 3rd Gen AMD EPYC™ | before MilanPI-SP3_1.0.0.4 | MilanPI-SP3_1.0.0.4 | Patch available | CNA |
- 1st Gen AMD EPYC™ VendorAMD Affected before NaplesPI-SP3_1.0.0.G Fixed in NaplesPI-SP3_1.0.0.G Patch available CNA
- 2nd Gen AMD EPYC™ VendorAMD Affected before RomePI-SP3_1.0.0.C Fixed in RomePI-SP3_1.0.0.C Patch available CNA
- 3rd Gen AMD EPYC™ VendorAMD Affected before MilanPI-SP3_1.0.0.4 Fixed in MilanPI-SP3_1.0.0.4 Patch available CNA
CPE configurations NVD · 116
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:amd:epyc_7003_firmware:*:*:*:*:*:*:*:* | before milanpi-sp3_1.0.0.4 | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7003:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7002_firmware:*:*:*:*:*:*:*:* | before romepi-sp3_1.0.0.c | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7002:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7001_firmware:*:*:*:*:*:*:*:* | before naplespi-sp3_1.0.0.g | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7001:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_72f3_firmware:*:*:*:*:*:*:*:* | before milanpi-sp3_1.0.0.4 | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_72f3:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7313_firmware:*:*:*:*:*:*:*:* | before milanpi-sp3_1.0.0.4 | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7313:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
- cpe:2.3:o:amd:epyc_7003_firmware:*:*:*:*:*:*:*:* Versions before milanpi-sp3_1.0.0.4 Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7003:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7002_firmware:*:*:*:*:*:*:*:* Versions before romepi-sp3_1.0.0.c Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7002:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7001_firmware:*:*:*:*:*:*:*:* Versions before naplespi-sp3_1.0.0.g Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7001:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_72f3_firmware:*:*:*:*:*:*:*:* Versions before milanpi-sp3_1.0.0.4 Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_72f3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7313_firmware:*:*:*:*:*:*:*:* Versions before milanpi-sp3_1.0.0.4 Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7313:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
Show 106 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:amd:epyc_7313p_firmware:*:*:*:*:*:*:*:* | before milanpi-sp3_1.0.0.4 | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7313p:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7343_firmware:*:*:*:*:*:*:*:* | before milanpi-sp3_1.0.0.4 | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7343:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_73f3_firmware:*:*:*:*:*:*:*:* | before milanpi-sp3_1.0.0.4 | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_73f3:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7413_firmware:*:*:*:*:*:*:*:* | before milanpi-sp3_1.0.0.4 | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7413:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7443_firmware:*:*:*:*:*:*:*:* | before milanpi-sp3_1.0.0.4 | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7443:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7443p_firmware:*:*:*:*:*:*:*:* | before milanpi-sp3_1.0.0.4 | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7443p:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7453_firmware:*:*:*:*:*:*:*:* | before milanpi-sp3_1.0.0.4 | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7453:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_74f3_firmware:*:*:*:*:*:*:*:* | before milanpi-sp3_1.0.0.4 | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_74f3:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7513_firmware:*:*:*:*:*:*:*:* | before milanpi-sp3_1.0.0.4 | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7513:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7543_firmware:*:*:*:*:*:*:*:* | before milanpi-sp3_1.0.0.4 | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7543:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7543p_firmware:*:*:*:*:*:*:*:* | before milanpi-sp3_1.0.0.4 | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7543p:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_75f3_firmware:*:*:*:*:*:*:*:* | before milanpi-sp3_1.0.0.4 | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_75f3:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7643_firmware:*:*:*:*:*:*:*:* | before milanpi-sp3_1.0.0.4 | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7643:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7663_firmware:*:*:*:*:*:*:*:* | before milanpi-sp3_1.0.0.4 | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7663:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7713_firmware:*:*:*:*:*:*:*:* | before milanpi-sp3_1.0.0.4 | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7713:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7713p_firmware:*:*:*:*:*:*:*:* | before milanpi-sp3_1.0.0.4 | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7713p:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7763_firmware:*:*:*:*:*:*:*:* | before milanpi-sp3_1.0.0.4 | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7763:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7232p_firmware:*:*:*:*:*:*:*:* | before romepi-sp3_1.0.0.c | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7232p:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7252_firmware:*:*:*:*:*:*:*:* | before romepi-sp3_1.0.0.c | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7252:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7262_firmware:*:*:*:*:*:*:*:* | before romepi-sp3_1.0.0.c | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7262:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7272_firmware:*:*:*:*:*:*:*:* | before romepi-sp3_1.0.0.c | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7272:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7282_firmware:*:*:*:*:*:*:*:* | before romepi-sp3_1.0.0.c | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7282:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7302_firmware:*:*:*:*:*:*:*:* | before romepi-sp3_1.0.0.c | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7302:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7302p_firmware:*:*:*:*:*:*:*:* | before romepi-sp3_1.0.0.c | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7302p:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7352_firmware:*:*:*:*:*:*:*:* | before romepi-sp3_1.0.0.c | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7352:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7402_firmware:*:*:*:*:*:*:*:* | before romepi-sp3_1.0.0.c | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7402:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7402p_firmware:*:*:*:*:*:*:*:* | before romepi-sp3_1.0.0.c | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7402p:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7452_firmware:*:*:*:*:*:*:*:* | before romepi-sp3_1.0.0.c | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7452:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7502_firmware:*:*:*:*:*:*:*:* | before romepi-sp3_1.0.0.c | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7502:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7502p_firmware:*:*:*:*:*:*:*:* | before romepi-sp3_1.0.0.c | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7502p:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7532_firmware:*:*:*:*:*:*:*:* | before romepi-sp3_1.0.0.c | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7532:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7542_firmware:*:*:*:*:*:*:*:* | before romepi-sp3_1.0.0.c | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7542:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7552_firmware:*:*:*:*:*:*:*:* | before romepi-sp3_1.0.0.c | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7552:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7642_firmware:*:*:*:*:*:*:*:* | before romepi-sp3_1.0.0.c | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7642:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7662_firmware:*:*:*:*:*:*:*:* | before romepi-sp3_1.0.0.c | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7662:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7702_firmware:*:*:*:*:*:*:*:* | before romepi-sp3_1.0.0.c | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7702:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7702p_firmware:*:*:*:*:*:*:*:* | before romepi-sp3_1.0.0.c | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7702p:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7742_firmware:*:*:*:*:*:*:*:* | before romepi-sp3_1.0.0.c | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7742:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7f32_firmware:*:*:*:*:*:*:*:* | before romepi-sp3_1.0.0.c | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7f32:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7f52_firmware:*:*:*:*:*:*:*:* | before romepi-sp3_1.0.0.c | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7f52:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7f72_firmware:*:*:*:*:*:*:*:* | before romepi-sp3_1.0.0.c | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7f72:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7251_firmware:*:*:*:*:*:*:*:* | before naplespi-sp3_1.0.0.g | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7251:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7281_firmware:*:*:*:*:*:*:*:* | before naplespi-sp3_1.0.0.g | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7281:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7301_firmware:*:*:*:*:*:*:*:* | before naplespi-sp3_1.0.0.g | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7301:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7351_firmware:*:*:*:*:*:*:*:* | before naplespi-sp3_1.0.0.g | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7351:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7351p_firmware:*:*:*:*:*:*:*:* | before naplespi-sp3_1.0.0.g | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7351p:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7401_firmware:*:*:*:*:*:*:*:* | before naplespi-sp3_1.0.0.g | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7401:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7401p_firmware:*:*:*:*:*:*:*:* | before naplespi-sp3_1.0.0.g | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7401p:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7451_firmware:*:*:*:*:*:*:*:* | before naplespi-sp3_1.0.0.g | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7451:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7501_firmware:*:*:*:*:*:*:*:* | before naplespi-sp3_1.0.0.g | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7501:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7551_firmware:*:*:*:*:*:*:*:* | before naplespi-sp3_1.0.0.g | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7551:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7551p_firmware:*:*:*:*:*:*:*:* | before naplespi-sp3_1.0.0.g | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7551p:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_7601_firmware:*:*:*:*:*:*:*:* | before naplespi-sp3_1.0.0.g | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc_7601:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
- cpe:2.3:o:amd:epyc_7313p_firmware:*:*:*:*:*:*:*:* Versions before milanpi-sp3_1.0.0.4 Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7313p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7343_firmware:*:*:*:*:*:*:*:* Versions before milanpi-sp3_1.0.0.4 Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7343:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_73f3_firmware:*:*:*:*:*:*:*:* Versions before milanpi-sp3_1.0.0.4 Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_73f3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7413_firmware:*:*:*:*:*:*:*:* Versions before milanpi-sp3_1.0.0.4 Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7413:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7443_firmware:*:*:*:*:*:*:*:* Versions before milanpi-sp3_1.0.0.4 Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7443:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7443p_firmware:*:*:*:*:*:*:*:* Versions before milanpi-sp3_1.0.0.4 Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7443p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7453_firmware:*:*:*:*:*:*:*:* Versions before milanpi-sp3_1.0.0.4 Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7453:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_74f3_firmware:*:*:*:*:*:*:*:* Versions before milanpi-sp3_1.0.0.4 Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_74f3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7513_firmware:*:*:*:*:*:*:*:* Versions before milanpi-sp3_1.0.0.4 Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7513:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7543_firmware:*:*:*:*:*:*:*:* Versions before milanpi-sp3_1.0.0.4 Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7543:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7543p_firmware:*:*:*:*:*:*:*:* Versions before milanpi-sp3_1.0.0.4 Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7543p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_75f3_firmware:*:*:*:*:*:*:*:* Versions before milanpi-sp3_1.0.0.4 Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_75f3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7643_firmware:*:*:*:*:*:*:*:* Versions before milanpi-sp3_1.0.0.4 Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7643:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7663_firmware:*:*:*:*:*:*:*:* Versions before milanpi-sp3_1.0.0.4 Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7663:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7713_firmware:*:*:*:*:*:*:*:* Versions before milanpi-sp3_1.0.0.4 Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7713:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7713p_firmware:*:*:*:*:*:*:*:* Versions before milanpi-sp3_1.0.0.4 Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7713p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7763_firmware:*:*:*:*:*:*:*:* Versions before milanpi-sp3_1.0.0.4 Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7763:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7232p_firmware:*:*:*:*:*:*:*:* Versions before romepi-sp3_1.0.0.c Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7232p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7252_firmware:*:*:*:*:*:*:*:* Versions before romepi-sp3_1.0.0.c Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7252:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7262_firmware:*:*:*:*:*:*:*:* Versions before romepi-sp3_1.0.0.c Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7262:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7272_firmware:*:*:*:*:*:*:*:* Versions before romepi-sp3_1.0.0.c Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7272:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7282_firmware:*:*:*:*:*:*:*:* Versions before romepi-sp3_1.0.0.c Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7282:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7302_firmware:*:*:*:*:*:*:*:* Versions before romepi-sp3_1.0.0.c Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7302:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7302p_firmware:*:*:*:*:*:*:*:* Versions before romepi-sp3_1.0.0.c Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7302p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7352_firmware:*:*:*:*:*:*:*:* Versions before romepi-sp3_1.0.0.c Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7352:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7402_firmware:*:*:*:*:*:*:*:* Versions before romepi-sp3_1.0.0.c Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7402:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7402p_firmware:*:*:*:*:*:*:*:* Versions before romepi-sp3_1.0.0.c Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7402p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7452_firmware:*:*:*:*:*:*:*:* Versions before romepi-sp3_1.0.0.c Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7452:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7502_firmware:*:*:*:*:*:*:*:* Versions before romepi-sp3_1.0.0.c Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7502:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7502p_firmware:*:*:*:*:*:*:*:* Versions before romepi-sp3_1.0.0.c Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7502p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7532_firmware:*:*:*:*:*:*:*:* Versions before romepi-sp3_1.0.0.c Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7532:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7542_firmware:*:*:*:*:*:*:*:* Versions before romepi-sp3_1.0.0.c Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7542:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7552_firmware:*:*:*:*:*:*:*:* Versions before romepi-sp3_1.0.0.c Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7552:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7642_firmware:*:*:*:*:*:*:*:* Versions before romepi-sp3_1.0.0.c Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7642:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7662_firmware:*:*:*:*:*:*:*:* Versions before romepi-sp3_1.0.0.c Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7662:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7702_firmware:*:*:*:*:*:*:*:* Versions before romepi-sp3_1.0.0.c Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7702:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7702p_firmware:*:*:*:*:*:*:*:* Versions before romepi-sp3_1.0.0.c Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7702p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7742_firmware:*:*:*:*:*:*:*:* Versions before romepi-sp3_1.0.0.c Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7742:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7f32_firmware:*:*:*:*:*:*:*:* Versions before romepi-sp3_1.0.0.c Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7f32:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7f52_firmware:*:*:*:*:*:*:*:* Versions before romepi-sp3_1.0.0.c Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7f52:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7f72_firmware:*:*:*:*:*:*:*:* Versions before romepi-sp3_1.0.0.c Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7f72:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7251_firmware:*:*:*:*:*:*:*:* Versions before naplespi-sp3_1.0.0.g Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7251:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7281_firmware:*:*:*:*:*:*:*:* Versions before naplespi-sp3_1.0.0.g Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7281:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7301_firmware:*:*:*:*:*:*:*:* Versions before naplespi-sp3_1.0.0.g Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7301:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7351_firmware:*:*:*:*:*:*:*:* Versions before naplespi-sp3_1.0.0.g Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7351:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7351p_firmware:*:*:*:*:*:*:*:* Versions before naplespi-sp3_1.0.0.g Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7351p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7401_firmware:*:*:*:*:*:*:*:* Versions before naplespi-sp3_1.0.0.g Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7401:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7401p_firmware:*:*:*:*:*:*:*:* Versions before naplespi-sp3_1.0.0.g Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7401p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7451_firmware:*:*:*:*:*:*:*:* Versions before naplespi-sp3_1.0.0.g Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7451:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7501_firmware:*:*:*:*:*:*:*:* Versions before naplespi-sp3_1.0.0.g Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7501:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7551_firmware:*:*:*:*:*:*:*:* Versions before naplespi-sp3_1.0.0.g Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7551:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7551p_firmware:*:*:*:*:*:*:*:* Versions before naplespi-sp3_1.0.0.g Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7551p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_7601_firmware:*:*:*:*:*:*:*:* Versions before naplespi-sp3_1.0.0.g Vulnerable ·AMD
- cpe:2.3:h:amd:epyc_7601:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
Remediation
- Fix · CNA 1st Gen AMD EPYC™ (AMD) Fixed in NaplesPI-SP3_1.0.0.G
- Fix · CNA 2nd Gen AMD EPYC™ (AMD) Fixed in RomePI-SP3_1.0.0.C
- Fix · CNA 3rd Gen AMD EPYC™ (AMD) Fixed in MilanPI-SP3_1.0.0.4
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
AMD 3rd Gen AMD EPYC™ MilanPI-SP3_1.0.0.4
14 records Highest priority Priority LOW 14 LOW
Other records, highest priority first
- TI-2021-08165 Improper access control in AMD 2nd Gen AMD EPYC™Priority LOW 35
- TI-2021-08149 Persistent platform private key may not be protected with a random IV leading to a potential “two time pad attack”.Priority LOW 35
- TI-2021-08153 Failure to validate VM_HSAVE_PA during SNP_INIT may result in a loss of memory integrity.Priority LOW 34
- Release ·
AMD 2nd Gen AMD EPYC™ RomePI-SP3_1.0.0.C
9 records Highest priority Priority LOW 9 LOW
Other records, highest priority first
- TI-2021-08165 Improper access control in AMD 2nd Gen AMD EPYC™Priority LOW 35
- TI-2021-08149 Persistent platform private key may not be protected with a random IV leading to a potential “two time pad attack”.Priority LOW 35
- TI-2020-10281 Improper input validation in AMD 2nd Gen AMD EPYC™Priority LOW 34
Show 1 more group
- Release ·
AMD 1st Gen AMD EPYC™ NaplesPI-SP3_1.0.0.G
7 records Highest priority Priority LOW 7 LOW
Other records, highest priority first
- TI-2021-08149 Persistent platform private key may not be protected with a random IV leading to a potential “two time pad attack”.Priority LOW 35
- TI-2021-08157 AMD System Management Unit (SMU) may experience a heap-based overflow which may result in a loss of resources.Priority LOW 24
- TI-2021-08156 Integer overflow in AMD 1st Gen AMD EPYC™Priority LOW 24
Timeline
- 2026-10-02 Threatist record created from CVE-2021-26331
- 2026-10-03 Alias added: GHSA-945g-xqmp-7xg3
References
More AMD Epyc 7001 Firmware vulnerabilities
- TI-2021-08171 Out-of-bounds write in AMD EPYC™ 7001 Series Processors CVSS 3.1HIGH 8.2
- TI-2022-12252 Mis-trained branch predictions for return instructions may allow arbitrary speculative… CVSS 3.1MEDIUM 6.5
- TI-2021-08167 A malicious hypervisor in conjunction with an unprivileged attacker process inside an… CVSS 3.1HIGH 8.4
- TI-2021-08217 Out-of-bounds write in AMD 1st Gen EPYC CVSS 3.1HIGH 7.8
- TI-2021-08183 Time-of-check time-of-use race condition in AMD Ryzen™ 3000 Series Desktop Processors… CVSS 3.1HIGH 7.4
- TI-2020-10295 A potential denial of service (DoS) vulnerability exists in the integrated chipset that… CVSS 3.1HIGH 7.5
Sources
- CVE-2021-26331 · CVE Program
- CVE-2021-26331 · NVD
- FIRST EPSS
- GHSA-945g-xqmp-7xg3 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences