CVE-2018-8932 : The AMD Ryzen and Ryzen Pro processor chips have insufficient access control for

The AMD Ryzen and Ryzen Pro processor chips have insufficient access control for the Secure Processor, aka RYZENFALL-2, RYZENFALL-3, and RYZENFALL-4.

Published 2018-03-22 14:29:01

Updated 2019-10-03 00:03:26

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2018-8932

AMD » Ryzen Pro Firmware » Version: N/A
cpe:2.3:o:amd:ryzen_pro_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Ryzen Pro » Version: N/A
AMD » Ryzen Firmware » Version: N/A
cpe:2.3:o:amd:ryzen_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Ryzen » Version: N/A

EPSS FAQ

0.37%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 69 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
9.3	HIGH	AV:N/AC:M/Au:N/C:C/I:C/A:C	8.6	10.0	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
9.0	CRITICAL	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H	2.2	6.0	NIST
Attack Vector: Network Attack Complexity: High Privileges Required: None User Interaction: None Scope: Changed Confidentiality: High Integrity: High Availability: High

CWE-732 Incorrect Permission Assignment for Critical Resource

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

Assigned by: nvd@nist.gov (Primary)

Jump to