Vulnerability · Published Feb 16, 2022 · Assigned by AMD
CVE-2021-39298
Medium 6.5
In plain English
A medium-severity privilege mismanagement in 2nd Gen EPYC from AMD. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.4%top 68.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A potential vulnerability in AMD System Management Mode (SMM) interrupt handler may allow an attacker with high privileges to access the SMM resulting in arbitrary code execution which could be used by malicious actors to bypass security mechanisms provided in the UEFI firmware.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| AMD | 2nd Gen EPYC | Various |
| AMD | 3rd Gen EPYC | various |
| AMD | Ryzen 2000 Series | various |
| AMD | Ryzen 3000 Series | Various |
| AMD | Ryzen 5000 Series | various |
Weakness: CWE-269 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H