CVE-2020-12944 : Insufficient validation of BIOS image length by ASP Firmware could lead to arbit

Insufficient validation of BIOS image length by ASP Firmware could lead to arbitrary code execution.

Published 2021-11-16 19:15:07

Updated 2022-10-06 15:45:34

Source Advanced Micro Devices Inc.

View at NVD, CVE.org

Vulnerability category: Input validation

Products affected by CVE-2020-12944

AMD » Epyc 7601 Firmware
Versions before (<) naplespi-sp3_1.0.0.g
cpe:2.3:o:amd:epyc_7601_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 7601 » Version: N/A
AMD » Epyc 7551p Firmware
Versions before (<) naplespi-sp3_1.0.0.g
cpe:2.3:o:amd:epyc_7551p_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 7551p » Version: N/A
AMD » Epyc 7551 Firmware
Versions before (<) naplespi-sp3_1.0.0.g
cpe:2.3:o:amd:epyc_7551_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 7551 » Version: N/A
AMD » Epyc 7501 Firmware
Versions before (<) naplespi-sp3_1.0.0.g
cpe:2.3:o:amd:epyc_7501_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 7501 » Version: N/A
AMD » Epyc 7451 Firmware
Versions before (<) naplespi-sp3_1.0.0.g
cpe:2.3:o:amd:epyc_7451_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 7451 » Version: N/A
AMD » Epyc 7401 Firmware
Versions before (<) naplespi-sp3_1.0.0.g
cpe:2.3:o:amd:epyc_7401_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 7401 » Version: N/A
AMD » Epyc 7371 Firmware
Versions before (<) naplespi-sp3_1.0.0.g
cpe:2.3:o:amd:epyc_7371_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 7371 » Version: N/A
AMD » Epyc 7351p Firmware
Versions before (<) naplespi-sp3_1.0.0.g
cpe:2.3:o:amd:epyc_7351p_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 7351p » Version: N/A
AMD » Epyc 7351 Firmware
Versions before (<) naplespi-sp3_1.0.0.g
cpe:2.3:o:amd:epyc_7351_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 7351 » Version: N/A
AMD » Epyc 7301 Firmware
Versions before (<) naplespi-sp3_1.0.0.g
cpe:2.3:o:amd:epyc_7301_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 7301 » Version: N/A
AMD » Epyc 7281 Firmware
Versions before (<) naplespi-sp3_1.0.0.g
cpe:2.3:o:amd:epyc_7281_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 7281 » Version: N/A
AMD » Epyc 7261 Firmware
Versions before (<) naplespi-sp3_1.0.0.g
cpe:2.3:o:amd:epyc_7261_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 7261 » Version: N/A
AMD » Epyc 7251 Firmware
Versions before (<) naplespi-sp3_1.0.0.g
cpe:2.3:o:amd:epyc_7251_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 7251 » Version: N/A
AMD » Epyc 7f72 Firmware
Versions before (<) romepi-sp3_1.0.0.c
cpe:2.3:o:amd:epyc_7f72_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 7f72 » Version: N/A
AMD » Epyc 7f52 Firmware
Versions before (<) romepi-sp3_1.0.0.c
cpe:2.3:o:amd:epyc_7f52_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 7f52 » Version: N/A
AMD » Epyc 7f32 Firmware
Versions before (<) romepi-sp3_1.0.0.c
cpe:2.3:o:amd:epyc_7f32_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 7f32 » Version: N/A
AMD » Epyc 7h12 Firmware
Versions before (<) romepi-sp3_1.0.0.c
cpe:2.3:o:amd:epyc_7h12_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 7h12 » Version: N/A
AMD » Epyc 7742 Firmware
Versions before (<) romepi-sp3_1.0.0.c
cpe:2.3:o:amd:epyc_7742_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 7742 » Version: N/A
AMD » Epyc 7702 Firmware
Versions before (<) romepi-sp3_1.0.0.c
cpe:2.3:o:amd:epyc_7702_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 7702 » Version: N/A
AMD » Epyc 7702p Firmware
Versions before (<) romepi-sp3_1.0.0.c
cpe:2.3:o:amd:epyc_7702p_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 7702p » Version: N/A
AMD » Epyc 7662 Firmware
Versions before (<) romepi-sp3_1.0.0.c
cpe:2.3:o:amd:epyc_7662_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 7662 » Version: N/A
AMD » Epyc 7642 Firmware
Versions before (<) romepi-sp3_1.0.0.c
cpe:2.3:o:amd:epyc_7642_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 7642 » Version: N/A
AMD » Epyc 7552 Firmware
Versions before (<) romepi-sp3_1.0.0.c
cpe:2.3:o:amd:epyc_7552_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 7552 » Version: N/A
AMD » Epyc 7542 Firmware
Versions before (<) romepi-sp3_1.0.0.c
cpe:2.3:o:amd:epyc_7542_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 7542 » Version: N/A
AMD » Epyc 7532 Firmware
Versions before (<) romepi-sp3_1.0.0.c
cpe:2.3:o:amd:epyc_7532_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 7532 » Version: N/A
AMD » Epyc 7502 Firmware
Versions before (<) romepi-sp3_1.0.0.c
cpe:2.3:o:amd:epyc_7502_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 7502 » Version: N/A
AMD » Epyc 7502p Firmware
Versions before (<) romepi-sp3_1.0.0.c
cpe:2.3:o:amd:epyc_7502p_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 7502p » Version: N/A
AMD » Epyc 7452 Firmware
Versions before (<) romepi-sp3_1.0.0.c
cpe:2.3:o:amd:epyc_7452_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 7452 » Version: N/A
AMD » Epyc 7402 Firmware
Versions before (<) romepi-sp3_1.0.0.c
cpe:2.3:o:amd:epyc_7402_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 7402 » Version: N/A
AMD » Epyc 7402p Firmware
Versions before (<) romepi-sp3_1.0.0.c
cpe:2.3:o:amd:epyc_7402p_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 7402p » Version: N/A
AMD » Epyc 7352 Firmware
Versions before (<) romepi-sp3_1.0.0.c
cpe:2.3:o:amd:epyc_7352_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 7352 » Version: N/A
AMD » Epyc 7302 Firmware
Versions before (<) romepi-sp3_1.0.0.c
cpe:2.3:o:amd:epyc_7302_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 7302 » Version: N/A
AMD » Epyc 7302p Firmware
Versions before (<) romepi-sp3_1.0.0.c
cpe:2.3:o:amd:epyc_7302p_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 7302p » Version: N/A
AMD » Epyc 7282 Firmware
Versions before (<) romepi-sp3_1.0.0.c
cpe:2.3:o:amd:epyc_7282_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 7282 » Version: N/A
AMD » Epyc 7272 Firmware
Versions before (<) romepi-sp3_1.0.0.c
cpe:2.3:o:amd:epyc_7272_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 7272 » Version: N/A
AMD » Epyc 7262 Firmware
Versions before (<) romepi-sp3_1.0.0.c
cpe:2.3:o:amd:epyc_7262_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 7262 » Version: N/A
AMD » Epyc 7252 Firmware
Versions before (<) romepi-sp3_1.0.0.c
cpe:2.3:o:amd:epyc_7252_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 7252 » Version: N/A
AMD » Epyc 7232p Firmware
Versions before (<) romepi-sp3_1.0.0.c
cpe:2.3:o:amd:epyc_7232p_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 7232p » Version: N/A
AMD » Epyc 7763 Firmware
Versions before (<) milanpi-sp3_1.0.0.4
cpe:2.3:o:amd:epyc_7763_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 7763 » Version: N/A
AMD » Epyc 7713p Firmware
Versions before (<) milanpi-sp3_1.0.0.4
cpe:2.3:o:amd:epyc_7713p_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 7713p » Version: N/A
AMD » Epyc 7713 Firmware
Versions before (<) milanpi-sp3_1.0.0.4
cpe:2.3:o:amd:epyc_7713_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 7713 » Version: N/A
AMD » Epyc 7663 Firmware
Versions before (<) milanpi-sp3_1.0.0.4
cpe:2.3:o:amd:epyc_7663_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 7663 » Version: N/A
AMD » Epyc 7643 Firmware
Versions before (<) milanpi-sp3_1.0.0.4
cpe:2.3:o:amd:epyc_7643_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 7643 » Version: N/A
AMD » Epyc 75f3 Firmware
Versions before (<) milanpi-sp3_1.0.0.4
cpe:2.3:o:amd:epyc_75f3_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 75f3 » Version: N/A
AMD » Epyc 7543p Firmware
Versions before (<) milanpi-sp3_1.0.0.4
cpe:2.3:o:amd:epyc_7543p_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 7543p » Version: N/A
AMD » Epyc 7543 Firmware
Versions before (<) milanpi-sp3_1.0.0.4
cpe:2.3:o:amd:epyc_7543_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 7543 » Version: N/A
AMD » Epyc 7513 Firmware
Versions before (<) milanpi-sp3_1.0.0.4
cpe:2.3:o:amd:epyc_7513_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 7513 » Version: N/A
AMD » Epyc 7453 Firmware
Versions before (<) milanpi-sp3_1.0.0.4
cpe:2.3:o:amd:epyc_7453_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 7453 » Version: N/A
AMD » Epyc 74f3 Firmware
Versions before (<) milanpi-sp3_1.0.0.4
cpe:2.3:o:amd:epyc_74f3_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 74f3 » Version: N/A
AMD » Epyc 7443p Firmware
Versions before (<) milanpi-sp3_1.0.0.4
cpe:2.3:o:amd:epyc_7443p_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 7443p » Version: N/A
AMD » Epyc 7443 Firmware
Versions before (<) milanpi-sp3_1.0.0.4
cpe:2.3:o:amd:epyc_7443_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 7443 » Version: N/A
AMD » Epyc 7413 Firmware
Versions before (<) milanpi-sp3_1.0.0.4
cpe:2.3:o:amd:epyc_7413_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 7413 » Version: N/A
AMD » Epyc 73f3 Firmware
Versions before (<) milanpi-sp3_1.0.0.4
cpe:2.3:o:amd:epyc_73f3_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 73f3 » Version: N/A
AMD » Epyc 7343 Firmware
Versions before (<) milanpi-sp3_1.0.0.4
cpe:2.3:o:amd:epyc_7343_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 7343 » Version: N/A
AMD » Epyc 7313p Firmware
Versions before (<) milanpi-sp3_1.0.0.4
cpe:2.3:o:amd:epyc_7313p_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 7313p » Version: N/A
AMD » Epyc 7313 Firmware
Versions before (<) milanpi-sp3_1.0.0.4
cpe:2.3:o:amd:epyc_7313_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 7313 » Version: N/A
AMD » Epyc 72f3 Firmware
Versions before (<) milanpi-sp3_1.0.0.4
cpe:2.3:o:amd:epyc_72f3_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 72f3 » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2020-12944

EPSS FAQ

0.14%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 36 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2020-12944

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.6	MEDIUM	AV:L/AC:L/Au:N/C:P/I:P/A:P	3.9	6.4	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	1.8	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2020-12944

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2020-12944

https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1027

AMD Client Vulnerabilities – May 2022 | AMD
Vendor Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2020-12944

Products affected by CVE-2020-12944

Exploit prediction scoring system (EPSS) score for CVE-2020-12944

CVSS scores for CVE-2020-12944

CWE ids for CVE-2020-12944

References for CVE-2020-12944