CVE-2023-20533

< comboam4v2_pi_1.2.0.9

Insufficient DRAM address validation in System Management Unit (SMU) may allow an attacker to read/write from/to an invalid DRAM a

6.1MEDIUM

CVE-2022-23821

all versions

Improper access control in System Management Mode (SMM) may allow an attacker to write to SPI ROM potentially leading to arbitrary

9.8CRITICAL

CVE-2022-23820

all versions

Failure to validate the AMD SMM communication buffer may allow an attacker to corrupt the SMRAM potentially leading to arbitrary c

7.5HIGH

CVE-2021-46774

< comboam4_v2_pi_1.2.0.6

Insufficient DRAM address validation in System Management Unit (SMU) may allow an attacker to read/write from/to an invalid DRAM a

6.7MEDIUM

CVE-2023-20589

all versions

An attacker with specialized hardware and physical access to an impacted device may be able to perform a voltage fault injection a

6.8MEDIUM

CVE-2023-20569

< comboam4v2pi_1.2.0.b

A side channel vulnerability on some of the AMD CPUs may allow an attacker to influence the return address prediction. This may re

4.7MEDIUM

CVE-2023-20555

< comboam4_v2_pi_1.2.0.a

Insufficient input validation in CpmDisplayFeatureSmm may allow an attacker to corrupt SMM memory by overwriting an arbitrary bit

7.8HIGH

CVE-2021-26371

all versions

A compromised or malicious ABL or UApp could send a SHA256 system call to the bootloader, which may result in exposure of ASP memo

5.5MEDIUM

CVE-2021-26365

all versions

Certain size values in firmware binary headers could trigger out of bounds reads during signature validation, leading to denial of

8.2HIGH

CVE-2021-26356

< comboam4_v2_pi_1.2.0.6

A TOCTOU in ASP bootloader may allow an attacker to tamper with the SPI ROM following data read to memory potentially resulting in

7.4HIGH

CVE-2021-26354

all versions

Insufficient bounds checking in ASP may allow an attacker to issue a system call from a compromised ABL which may cause arbitrary

5.5MEDIUM

CVE-2021-26346

all versions

Failure to validate the integer operand in ASP (AMD Secure Processor) bootloader may allow an attacker to introduce an integer ove

5.5MEDIUM

CVE-2021-26316

all versions

Failure to validate the communication buffer and communication service in the BIOS may allow an attacker to tamper with the buffer

7.8HIGH

CVE-2021-26392

all versions

Insufficient verification of missing size check in 'LoadModule' may lead to an out-of-bounds write potentially allowing an attacke

7.8HIGH

CVE-2020-12931

all versions

Improper parameters handling in the AMD Secure Processor (ASP) kernel may allow a privileged attacker to elevate their privileges

7.8HIGH

CVE-2020-12930

all versions

Improper parameters handling in AMD Secure Processor (ASP) drivers may allow a privileged attacker to elevate their privileges pot

7.8HIGH