Read the docs
TI-2021-08170 Aliases CVE-2021-26343GHSA-m338-vvr5-wrph

Exposure of resource to wrong sphere in AMD 3rd Gen EPYC

Priority LOW 24CWE-668Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-668 and the CVSS impact.

Summary

Insufficient validation in ASP BIOS and DRTM commands may allow malicious supervisor x86 software to disclose the contents of sensitive memory which may result in information disclosure.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0019 8th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AMD3rd Gen EPYCvarious —No fix listedCNA
  • 3rd Gen EPYC VendorAMD Affected various Fixed in — No fix listed CNA

CPE configurations NVD · 48

CPEVersionsRoleVendor
cpe:2.3:o:amd:epyc_7003_firmware:*:*:*:*:*:*:*:*before milanpi_1.0.0.3VulnerableAMD
cpe:2.3:h:amd:epyc_7003:-:*:*:*:*:*:*:*not specified by NVDRunning onAMD
cpe:2.3:o:amd:epyc_72f3_firmware:*:*:*:*:*:*:*:*before milanpi_1.0.0.3VulnerableAMD
cpe:2.3:h:amd:epyc_72f3:-:*:*:*:*:*:*:*not specified by NVDRunning onAMD
cpe:2.3:o:amd:epyc_7313_firmware:*:*:*:*:*:*:*:*before milanpi_1.0.0.3VulnerableAMD
cpe:2.3:h:amd:epyc_7313:-:*:*:*:*:*:*:*not specified by NVDRunning onAMD
cpe:2.3:o:amd:epyc_7313p_firmware:*:*:*:*:*:*:*:*before milanpi_1.0.0.3VulnerableAMD
cpe:2.3:h:amd:epyc_7313p:-:*:*:*:*:*:*:*not specified by NVDRunning onAMD
cpe:2.3:o:amd:epyc_7343_firmware:*:*:*:*:*:*:*:*before milanpi_1.0.0.3VulnerableAMD
cpe:2.3:h:amd:epyc_7343:-:*:*:*:*:*:*:*not specified by NVDRunning onAMD
  • cpe:2.3:o:amd:epyc_7003_firmware:*:*:*:*:*:*:*:* Versions before milanpi_1.0.0.3 Vulnerable ·AMD
  • cpe:2.3:h:amd:epyc_7003:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
  • cpe:2.3:o:amd:epyc_72f3_firmware:*:*:*:*:*:*:*:* Versions before milanpi_1.0.0.3 Vulnerable ·AMD
  • cpe:2.3:h:amd:epyc_72f3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
  • cpe:2.3:o:amd:epyc_7313_firmware:*:*:*:*:*:*:*:* Versions before milanpi_1.0.0.3 Vulnerable ·AMD
  • cpe:2.3:h:amd:epyc_7313:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
  • cpe:2.3:o:amd:epyc_7313p_firmware:*:*:*:*:*:*:*:* Versions before milanpi_1.0.0.3 Vulnerable ·AMD
  • cpe:2.3:h:amd:epyc_7313p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
  • cpe:2.3:o:amd:epyc_7343_firmware:*:*:*:*:*:*:*:* Versions before milanpi_1.0.0.3 Vulnerable ·AMD
  • cpe:2.3:h:amd:epyc_7343:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
Show 38 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:amd:epyc_7373x_firmware:*:*:*:*:*:*:*:*before milanpi_1.0.0.3VulnerableAMD
cpe:2.3:h:amd:epyc_7373x:-:*:*:*:*:*:*:*not specified by NVDRunning onAMD
cpe:2.3:o:amd:epyc_73f3_firmware:*:*:*:*:*:*:*:*before milanpi_1.0.0.3VulnerableAMD
cpe:2.3:h:amd:epyc_73f3:-:*:*:*:*:*:*:*not specified by NVDRunning onAMD
cpe:2.3:o:amd:epyc_7413_firmware:*:*:*:*:*:*:*:*before milanpi_1.0.0.3VulnerableAMD
cpe:2.3:h:amd:epyc_7413:-:*:*:*:*:*:*:*not specified by NVDRunning onAMD
cpe:2.3:o:amd:epyc_7443_firmware:*:*:*:*:*:*:*:*before milanpi_1.0.0.3VulnerableAMD
cpe:2.3:h:amd:epyc_7443:-:*:*:*:*:*:*:*not specified by NVDRunning onAMD
cpe:2.3:o:amd:epyc_7443p_firmware:*:*:*:*:*:*:*:*before milanpi_1.0.0.3VulnerableAMD
cpe:2.3:h:amd:epyc_7443p:-:*:*:*:*:*:*:*not specified by NVDRunning onAMD
cpe:2.3:o:amd:epyc_7453_firmware:*:*:*:*:*:*:*:*before milanpi_1.0.0.3VulnerableAMD
cpe:2.3:h:amd:epyc_7453:-:*:*:*:*:*:*:*not specified by NVDRunning onAMD
cpe:2.3:o:amd:epyc_74f3_firmware:*:*:*:*:*:*:*:*before milanpi_1.0.0.3VulnerableAMD
cpe:2.3:h:amd:epyc_74f3:-:*:*:*:*:*:*:*not specified by NVDRunning onAMD
cpe:2.3:o:amd:epyc_7513_firmware:*:*:*:*:*:*:*:*before milanpi_1.0.0.3VulnerableAMD
cpe:2.3:h:amd:epyc_7513:-:*:*:*:*:*:*:*not specified by NVDRunning onAMD
cpe:2.3:o:amd:epyc_7543_firmware:*:*:*:*:*:*:*:*before milanpi_1.0.0.3VulnerableAMD
cpe:2.3:h:amd:epyc_7543:-:*:*:*:*:*:*:*not specified by NVDRunning onAMD
cpe:2.3:o:amd:epyc_7543p_firmware:*:*:*:*:*:*:*:*before milanpi_1.0.0.3VulnerableAMD
cpe:2.3:h:amd:epyc_7543p:-:*:*:*:*:*:*:*not specified by NVDRunning onAMD
cpe:2.3:o:amd:epyc_7573x_firmware:*:*:*:*:*:*:*:*before milanpi_1.0.0.3VulnerableAMD
cpe:2.3:h:amd:epyc_7573x:-:*:*:*:*:*:*:*not specified by NVDRunning onAMD
cpe:2.3:o:amd:epyc_75f3_firmware:*:*:*:*:*:*:*:*before milanpi_1.0.0.3VulnerableAMD
cpe:2.3:h:amd:epyc_75f3:-:*:*:*:*:*:*:*not specified by NVDRunning onAMD
cpe:2.3:o:amd:epyc_7643_firmware:*:*:*:*:*:*:*:*before milanpi_1.0.0.3VulnerableAMD
cpe:2.3:h:amd:epyc_7643:-:*:*:*:*:*:*:*not specified by NVDRunning onAMD
cpe:2.3:o:amd:epyc_7663_firmware:*:*:*:*:*:*:*:*before milanpi_1.0.0.3VulnerableAMD
cpe:2.3:h:amd:epyc_7663:-:*:*:*:*:*:*:*not specified by NVDRunning onAMD
cpe:2.3:o:amd:epyc_7713_firmware:*:*:*:*:*:*:*:*before milanpi_1.0.0.3VulnerableAMD
cpe:2.3:h:amd:epyc_7713:-:*:*:*:*:*:*:*not specified by NVDRunning onAMD
cpe:2.3:o:amd:epyc_7713p_firmware:*:*:*:*:*:*:*:*before milanpi_1.0.0.3VulnerableAMD
cpe:2.3:h:amd:epyc_7713p:-:*:*:*:*:*:*:*not specified by NVDRunning onAMD
cpe:2.3:o:amd:epyc_7743_firmware:*:*:*:*:*:*:*:*before milanpi_1.0.0.3VulnerableAMD
cpe:2.3:h:amd:epyc_7743:-:*:*:*:*:*:*:*not specified by NVDRunning onAMD
cpe:2.3:o:amd:epyc_7763_firmware:*:*:*:*:*:*:*:*before milanpi_1.0.0.3VulnerableAMD
cpe:2.3:h:amd:epyc_7763:-:*:*:*:*:*:*:*not specified by NVDRunning onAMD
cpe:2.3:o:amd:epyc_7773x_firmware:*:*:*:*:*:*:*:*before milanpi_1.0.0.3VulnerableAMD
cpe:2.3:h:amd:epyc_7773x:-:*:*:*:*:*:*:*not specified by NVDRunning onAMD
  • cpe:2.3:o:amd:epyc_7373x_firmware:*:*:*:*:*:*:*:* Versions before milanpi_1.0.0.3 Vulnerable ·AMD
  • cpe:2.3:h:amd:epyc_7373x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
  • cpe:2.3:o:amd:epyc_73f3_firmware:*:*:*:*:*:*:*:* Versions before milanpi_1.0.0.3 Vulnerable ·AMD
  • cpe:2.3:h:amd:epyc_73f3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
  • cpe:2.3:o:amd:epyc_7413_firmware:*:*:*:*:*:*:*:* Versions before milanpi_1.0.0.3 Vulnerable ·AMD
  • cpe:2.3:h:amd:epyc_7413:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
  • cpe:2.3:o:amd:epyc_7443_firmware:*:*:*:*:*:*:*:* Versions before milanpi_1.0.0.3 Vulnerable ·AMD
  • cpe:2.3:h:amd:epyc_7443:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
  • cpe:2.3:o:amd:epyc_7443p_firmware:*:*:*:*:*:*:*:* Versions before milanpi_1.0.0.3 Vulnerable ·AMD
  • cpe:2.3:h:amd:epyc_7443p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
  • cpe:2.3:o:amd:epyc_7453_firmware:*:*:*:*:*:*:*:* Versions before milanpi_1.0.0.3 Vulnerable ·AMD
  • cpe:2.3:h:amd:epyc_7453:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
  • cpe:2.3:o:amd:epyc_74f3_firmware:*:*:*:*:*:*:*:* Versions before milanpi_1.0.0.3 Vulnerable ·AMD
  • cpe:2.3:h:amd:epyc_74f3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
  • cpe:2.3:o:amd:epyc_7513_firmware:*:*:*:*:*:*:*:* Versions before milanpi_1.0.0.3 Vulnerable ·AMD
  • cpe:2.3:h:amd:epyc_7513:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
  • cpe:2.3:o:amd:epyc_7543_firmware:*:*:*:*:*:*:*:* Versions before milanpi_1.0.0.3 Vulnerable ·AMD
  • cpe:2.3:h:amd:epyc_7543:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
  • cpe:2.3:o:amd:epyc_7543p_firmware:*:*:*:*:*:*:*:* Versions before milanpi_1.0.0.3 Vulnerable ·AMD
  • cpe:2.3:h:amd:epyc_7543p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
  • cpe:2.3:o:amd:epyc_7573x_firmware:*:*:*:*:*:*:*:* Versions before milanpi_1.0.0.3 Vulnerable ·AMD
  • cpe:2.3:h:amd:epyc_7573x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
  • cpe:2.3:o:amd:epyc_75f3_firmware:*:*:*:*:*:*:*:* Versions before milanpi_1.0.0.3 Vulnerable ·AMD
  • cpe:2.3:h:amd:epyc_75f3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
  • cpe:2.3:o:amd:epyc_7643_firmware:*:*:*:*:*:*:*:* Versions before milanpi_1.0.0.3 Vulnerable ·AMD
  • cpe:2.3:h:amd:epyc_7643:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
  • cpe:2.3:o:amd:epyc_7663_firmware:*:*:*:*:*:*:*:* Versions before milanpi_1.0.0.3 Vulnerable ·AMD
  • cpe:2.3:h:amd:epyc_7663:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
  • cpe:2.3:o:amd:epyc_7713_firmware:*:*:*:*:*:*:*:* Versions before milanpi_1.0.0.3 Vulnerable ·AMD
  • cpe:2.3:h:amd:epyc_7713:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
  • cpe:2.3:o:amd:epyc_7713p_firmware:*:*:*:*:*:*:*:* Versions before milanpi_1.0.0.3 Vulnerable ·AMD
  • cpe:2.3:h:amd:epyc_7713p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
  • cpe:2.3:o:amd:epyc_7743_firmware:*:*:*:*:*:*:*:* Versions before milanpi_1.0.0.3 Vulnerable ·AMD
  • cpe:2.3:h:amd:epyc_7743:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
  • cpe:2.3:o:amd:epyc_7763_firmware:*:*:*:*:*:*:*:* Versions before milanpi_1.0.0.3 Vulnerable ·AMD
  • cpe:2.3:h:amd:epyc_7763:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
  • cpe:2.3:o:amd:epyc_7773x_firmware:*:*:*:*:*:*:*:* Versions before milanpi_1.0.0.3 Vulnerable ·AMD
  • cpe:2.3:h:amd:epyc_7773x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-26343
  2. 2026-10-03 Alias added: GHSA-m338-vvr5-wrph

References

Advisory 1

  • TI-2021-08144 Improper input validation in AMD Ryzen 5000 Series CVSS 3.1HIGH 7.8
  • TI-2021-08217 Out-of-bounds write in AMD 1st Gen EPYC CVSS 3.1HIGH 7.8
  • TI-2020-10295 A potential denial of service (DoS) vulnerability exists in the integrated chipset that… CVSS 3.1HIGH 7.5
  • TI-2023-07003 Memory corruption in AMD 2nd Gen EPYC CVSS 3.1HIGH 7.5
  • TI-2023-07002 Improper input validation in AMD 3rd Gen EPYC CVSS 3.1HIGH 7.5
  • TI-2023-07001 Memory corruption in AMD 2nd Gen EPYC CVSS 3.1HIGH 7.5
See all 33 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences