Vulnerability Details : CVE-2021-26311
In the AMD SEV/SEV-ES feature, memory can be rearranged in the guest address space that is not detected by the attestation mechanism which could be used by a malicious hypervisor to potentially lead to arbitrary code execution within the guest VM if a malicious administrator has access to compromise the server hypervisor.
Products affected by CVE-2021-26311
- cpe:2.3:h:amd:epyc_7251:-:*:*:*:*:*:*:*
- cpe:2.3:h:amd:epyc_7261:-:*:*:*:*:*:*:*
- cpe:2.3:h:amd:epyc_7281:-:*:*:*:*:*:*:*
- cpe:2.3:h:amd:epyc_7301:-:*:*:*:*:*:*:*
- cpe:2.3:h:amd:epyc_7351:-:*:*:*:*:*:*:*
- cpe:2.3:h:amd:epyc_7351p:-:*:*:*:*:*:*:*
- cpe:2.3:h:amd:epyc_7371:-:*:*:*:*:*:*:*
- cpe:2.3:h:amd:epyc_7401:-:*:*:*:*:*:*:*
- cpe:2.3:h:amd:epyc_7401p:-:*:*:*:*:*:*:*
- cpe:2.3:h:amd:epyc_7451:-:*:*:*:*:*:*:*
- cpe:2.3:h:amd:epyc_7501:-:*:*:*:*:*:*:*
- cpe:2.3:h:amd:epyc_7551:-:*:*:*:*:*:*:*
- cpe:2.3:h:amd:epyc_7551p:-:*:*:*:*:*:*:*
- cpe:2.3:h:amd:epyc_7601:-:*:*:*:*:*:*:*
- cpe:2.3:h:amd:epyc_7232p:-:*:*:*:*:*:*:*
- cpe:2.3:h:amd:epyc_7252:-:*:*:*:*:*:*:*
- cpe:2.3:h:amd:epyc_7262:-:*:*:*:*:*:*:*
- cpe:2.3:h:amd:epyc_7272:-:*:*:*:*:*:*:*
- cpe:2.3:h:amd:epyc_7282:-:*:*:*:*:*:*:*
- cpe:2.3:h:amd:epyc_72f3:-:*:*:*:*:*:*:*
- cpe:2.3:h:amd:epyc_7302:-:*:*:*:*:*:*:*
- cpe:2.3:h:amd:epyc_7302p:-:*:*:*:*:*:*:*
- cpe:2.3:h:amd:epyc_7313:-:*:*:*:*:*:*:*
- cpe:2.3:h:amd:epyc_7313p:-:*:*:*:*:*:*:*
- cpe:2.3:h:amd:epyc_7343:-:*:*:*:*:*:*:*
- cpe:2.3:h:amd:epyc_7352:-:*:*:*:*:*:*:*
- cpe:2.3:h:amd:epyc_73f3:-:*:*:*:*:*:*:*
- cpe:2.3:h:amd:epyc_7402:-:*:*:*:*:*:*:*
- cpe:2.3:h:amd:epyc_7402p:-:*:*:*:*:*:*:*
- cpe:2.3:h:amd:epyc_7413:-:*:*:*:*:*:*:*
- cpe:2.3:h:amd:epyc_7443:-:*:*:*:*:*:*:*
- cpe:2.3:h:amd:epyc_7443p:-:*:*:*:*:*:*:*
- cpe:2.3:h:amd:epyc_7452:-:*:*:*:*:*:*:*
- cpe:2.3:h:amd:epyc_7453:-:*:*:*:*:*:*:*
- cpe:2.3:h:amd:epyc_74f3:-:*:*:*:*:*:*:*
- cpe:2.3:h:amd:epyc_7502:-:*:*:*:*:*:*:*
- cpe:2.3:h:amd:epyc_7502p:-:*:*:*:*:*:*:*
- cpe:2.3:h:amd:epyc_7513:-:*:*:*:*:*:*:*
- cpe:2.3:h:amd:epyc_7532:-:*:*:*:*:*:*:*
- cpe:2.3:h:amd:epyc_7542:-:*:*:*:*:*:*:*
- cpe:2.3:h:amd:epyc_7543:-:*:*:*:*:*:*:*
- cpe:2.3:h:amd:epyc_7543p:-:*:*:*:*:*:*:*
- cpe:2.3:h:amd:epyc_7552:-:*:*:*:*:*:*:*
- cpe:2.3:h:amd:epyc_75f3:-:*:*:*:*:*:*:*
- cpe:2.3:h:amd:epyc_7642:-:*:*:*:*:*:*:*
- cpe:2.3:h:amd:epyc_7643:-:*:*:*:*:*:*:*
- cpe:2.3:h:amd:epyc_7662:-:*:*:*:*:*:*:*
- cpe:2.3:h:amd:epyc_7663:-:*:*:*:*:*:*:*
- cpe:2.3:h:amd:epyc_7702:-:*:*:*:*:*:*:*
- cpe:2.3:h:amd:epyc_7702p:-:*:*:*:*:*:*:*
- cpe:2.3:h:amd:epyc_7713:-:*:*:*:*:*:*:*
- cpe:2.3:h:amd:epyc_7713p:-:*:*:*:*:*:*:*
- cpe:2.3:h:amd:epyc_7742:-:*:*:*:*:*:*:*
- cpe:2.3:h:amd:epyc_7763:-:*:*:*:*:*:*:*
- cpe:2.3:h:amd:epyc_7f32:-:*:*:*:*:*:*:*
- cpe:2.3:h:amd:epyc_7f52:-:*:*:*:*:*:*:*
- cpe:2.3:h:amd:epyc_7f72:-:*:*:*:*:*:*:*
- cpe:2.3:h:amd:epyc_7h12:-:*:*:*:*:*:*:*
- cpe:2.3:h:amd:epyc_embedded_3101:-:*:*:*:*:*:*:*
- cpe:2.3:h:amd:epyc_embedded_3151:-:*:*:*:*:*:*:*
- cpe:2.3:h:amd:epyc_embedded_3201:-:*:*:*:*:*:*:*
- cpe:2.3:h:amd:epyc_embedded_3251:-:*:*:*:*:*:*:*
- cpe:2.3:h:amd:epyc_embedded_3255:-:*:*:*:*:*:*:*
- cpe:2.3:h:amd:epyc_embedded_3351:-:*:*:*:*:*:*:*
- cpe:2.3:h:amd:epyc_embedded_3451:-:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2021-26311
0.09%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 39 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2021-26311
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
9.0
|
HIGH | AV:N/AC:L/Au:S/C:C/I:C/A:C |
8.0
|
10.0
|
NIST | |
|
7.2
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
1.2
|
5.9
|
NIST |
CWE ids for CVE-2021-26311
-
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.Assigned by: nvd@nist.gov (Primary)
References for CVE-2021-26311
-
https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1004
Access DeniedVendor Advisory
Jump to