CVE Feed

    Dashboard / CVE / CVE-2019-9836

    CVE-2019-9836

    Secure Encrypted Virtualization (SEV) on Advanced Micro Devices (AMD) Platform Security Processor (PSP; aka AMD Secure Processor or AMD-SP) 0.17 build 11 and earlier has an insecure cryptographic implementation.

    Published:Jun 25, 2019
    Last Modified:Nov 21, 2024
    EPS:Jun 25, 2019
    EPSS Score:0.00269
    CVSS Score:5.3

    Affected Products

    Vendor
    Amd
    Product
    Epyc 7251
    Vendor
    Amd
    Product
    Epyc 7261
    Vendor
    Amd
    Product
    Epyc 7281
    Vendor
    Amd
    Product
    Epyc 7301
    Vendor
    Amd
    Product
    Epyc 7351
    Vendor
    Amd
    Product
    Epyc 7351p
    Vendor
    Amd
    Product
    Epyc 7371
    Vendor
    Amd
    Product
    Epyc 7401
    Vendor
    Amd
    Product
    Epyc 7401p
    Vendor
    Amd
    Product
    Epyc 7451
    Vendor
    Amd
    Product
    Epyc 7501
    Vendor
    Amd
    Product
    Epyc 7551
    Vendor
    Amd
    Product
    Epyc 7551p
    Vendor
    Amd
    Product
    Epyc 7601
    Vendor
    Amd
    Product
    Secure Encrypted Virtualization Firmware
    Vendor
    Opensuse
    Product
    Leap

    Exploits

    No exploit reference

    Related CVEs

    CVE-2023-20578 (CVSS 7.5) — A TOCTOU (Time-Of-Check-Time-Of-Use) in SMM may allow an attacker with ring0 privileges and access to the BIOS…
    CVE-2021-26344 (CVSS 7.2) — An out of bounds memory write when processing the AMD PSP1 Configuration Block (APCB) could allow an attacker …
    CVE-2023-20526 (CVSS 1.9) — Insufficient input validation in the ASP Bootloader may enable a privileged attacker with physical access to e…
    CVE-2023-20521 (CVSS 3.3) — TOCTOU in the ASP Bootloader may allow an attacker with physical access to tamper with SPI ROM records after m…
    CVE-2021-46774 (CVSS 6.7) — Insufficient DRAM address validation in System Management Unit (SMU) may allow an attacker to read/write from/…
    CVE-2023-20592 (CVSS 6.5) — Improper or unexpected behavior of the INVD instruction in some AMD CPUs may allow an attacker with a maliciou…
    CVE-2023-20588 (CVSS 5.5) — A division-by-zero error on some AMD processors can potentially return speculative data resulting in loss of …
    CVE-2023-20575 (CVSS 6.5) — A potential power side-channel vulnerability in some AMD processors may allow an authenticated attacker to us…
    CVE-2021-46756 (CVSS 9.1) — Insufficient validation of inputs in SVC_MAP_USER_STACK in the ASP (AMD Secure Processor) bootloader may allow…
    CVE-2021-26406 (CVSS 7.5) — Insufficient validation in parsing Owner's Certificate Authority (OCA) certificates in SEV (AMD Secure Encrypt…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High