Vulnerabilidades em AMD

467 resultados
Análise Vexday

O portfólio de vulnerabilidades da AMD reúne 443 CVEs catalogadas, com 59 registros surgidos nos últimos 90 dias, indicando um ritmo de descoberta que merece acompanhamento contínuo. A taxa de exploração ativa está abaixo da média geral do catálogo, com zero entradas no CISA KEV, o que sugere pressão operacional imediata menor em comparação com outros fornecedores. No entanto, a CVE mais perigosa atualmente monitorada, CVE-2023-20588, apresenta o maior EPSS observado no conjunto (0,1241), sinalizando probabilidade não negligenciável de exploração e justificando priorização nas rotinas de patch. A falha mais frequente, CWE-20 (validação inadequada de entrada), reflete uma fragilidade estrutural recorrente no código, enquanto as 6 CVEs de severidade crítica e a existência de pelo menos uma prova de conceito pública reforçam a necessidade de gestão ativa mesmo sem exploração confirmada no momento.

CVE-2023-20524HIGHAn attacker with a compromised ASP could possibly send malformed commands to an ASP on another CPU, resulting in an out of bounds write, potEPSS 0.5%CVE-2024-21978MEDIUMImproper input validation in SEV-SNP could allow a malicious hypervisor to read or overwrite guest memory potentially leading to data leakagEPSS 0.5%CVE-2022-23814MEDIUMFailure to validate addresses provided by software to BIOS commands may result in a potential loss of integrity of guest memory in a confideEPSS 0.5%CVE-2023-20598HIGH An improper privilege management in the AMD Radeon™ Graphics driver may allow an authenticated attacker to craft an IOCTL request to gainEPSS 0.5%CVE-2023-31347MEDIUMDue to a code bug in Secure_TSC, SEV firmware may allow an attacker with high privileges to cause a guest to observe an incorrect TSC when SEPSS 0.5%CVE-2024-21980HIGHImproper restriction of write operations in SNP firmware could allow a malicious hypervisor to potentially overwrite a guest's memory or UMCEPSS 0.4%CVE-2023-20571—A race condition in System Management Mode (SMM) code may allow an attacker using a compromised user space to leverage CVE-2018-8897 potentiEPSS 0.4%CVE-2023-31355MEDIUMImproper restriction of write operations in SNP firmware could allow a malicious hypervisor to overwrite a guest's UMC seed potentially alloEPSS 0.4%CVE-2026-40677HIGHThe use of insecure HTTP transport within AMD optional tools could allow an attacker to conduct a man-in-the-middle attack, potentially leadEPSS 0.4%CVE-2021-26345LOWFailure to validate the value in APCB may allow a privileged attacker to tamper with the APCB token to force an out-of-bounds memory read poEPSS 0.4%CVE-2021-26406HIGHInsufficient validation in parsing Owner's Certificate Authority (OCA) certificates in SEV (AMD Secure Encrypted Virtualization) and SEV-ES EPSS 0.4%CVE-2023-20511MEDIUMRelease of an invalid pointer in the AMD kernel mode driver (KMD) could allow a privileged attacker to create a double free condition potentEPSS 0.4%CVE-2021-26356HIGHA TOCTOU in ASP bootloader may allow an attacker to tamper with the SPI ROM following data read to memory potentially resulting in S3 data cEPSS 0.4%CVE-2021-46792MEDIUMTime-of-check Time-of-use (TOCTOU) in the BIOS2PSP command may allow an attacker with a malicious BIOS to create a race condition causing thEPSS 0.4%CVE-2021-39298MEDIUMA potential vulnerability in AMD System Management Mode (SMM) interrupt handler may allow an attacker with high privileges to access the SMMEPSS 0.4%CVE-2023-20566MEDIUMImproper address validation in ASP with SNP enabled may potentially allow an attacker to compromise guest memory integrity.EPSS 0.4%CVE-2024-36357MEDIUMA transient execution vulnerability in some AMD processors may allow an attacker to infer data in the L1D cache, potentially resulting in thEPSS 0.4%CVE-2025-52534MEDIUMImproper bound check within AMD CPU microcode can allow a malicious guest to write to host memory, potentially resulting in loss of integritEPSS 0.4%CVE-2021-46762LOWInsufficient input validation in the SMU may allow an attacker to corrupt SMU SRAM potentially leading to a loss of integrity or denial of sEPSS 0.3%CVE-2024-21961MEDIUMImproper restriction of operations within the bounds of a memory buffer in PCIe® Link could allow an attacker with access to a guest virtualEPSS 0.3%