Skip to content
Fencer Vulns
medium 4.7

CVE-2021-26347 json

Failure to validate the integer operand in ASP (AMD Secure Processor) bootloader may allow an attacker to introduce an integer overflow in…

published 2022-05-11 4 y ago modified 2026-06-17 4 mo ago also EUVD-2021-13153

cvss
4.7
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 9%
public exploits
0
none known

Summary

Failure to validate the integer operand in ASP (AMD Secure Processor) bootloader may allow an attacker to introduce an integer overflow in the L2 directory table in SPI flash resulting in a potential denial of service.

Patch / fix

  • amd epyc_7763_firmware milanpi-sp3_1.0.0.7
  • amd epyc_7713p_firmware milanpi-sp3_1.0.0.7
  • amd epyc_7713_firmware milanpi-sp3_1.0.0.7
  • amd epyc_7663_firmware milanpi-sp3_1.0.0.7
  • amd epyc_7643_firmware milanpi-sp3_1.0.0.7
  • amd epyc_75f3_firmware milanpi-sp3_1.0.0.7
  • amd epyc_7543p_firmware milanpi-sp3_1.0.0.7
  • amd epyc_7543_firmware milanpi-sp3_1.0.0.7
  • amd epyc_7513_firmware milanpi-sp3_1.0.0.7
  • amd epyc_7453_firmware milanpi-sp3_1.0.0.7
  • amd epyc_74f3_firmware milanpi-sp3_1.0.0.7
  • amd epyc_7443p_firmware milanpi-sp3_1.0.0.7
  • amd epyc_7443_firmware milanpi-sp3_1.0.0.7
  • amd epyc_7413_firmware milanpi-sp3_1.0.0.7
  • amd epyc_73f3_firmware milanpi-sp3_1.0.0.7
  • amd epyc_7343_firmware milanpi-sp3_1.0.0.7
  • amd epyc_7313p_firmware milanpi-sp3_1.0.0.7
  • amd epyc_7313_firmware milanpi-sp3_1.0.0.7
  • amd epyc_72f3_firmware milanpi-sp3_1.0.0.7
  • amd epyc_7773x_firmware milanpi-sp3_1.0.0.7
  • kernel-firmware SLE Module for Basesystem 15 SP4, openSUSE Leap 15.4 20220509-150400.4.5.1
  • kernel-firmware SLES for SAP 15, SLES 15-LTSS, SLE High Performance Computing 15-LTSS +1 more 20191118-150000.3.42.1
  • kernel-firmware SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES 12 SP5 +3 more 20190618-5.25.2
  • kernel-firmware SLE Module for Basesystem 15 SP3, SLE Micro 5.2, SLE Micro 5.1 +1 more 20210208-150300.4.10.1
  • kernel-firmware SLES for SAP 15 SP2, SLES for SAP 15 SP1, SLES 15 SP2-LTSS +12 more 20200107-150100.3.31.1

suse advisories SUSE-SU-2022:1923-1SUSE-SU-2022:1847-1SUSE-SU-2022:1846-1SUSE-SU-2022:1840-1SUSE-SU-2022:1751-1

Exploit prediction

0.20% chance of exploitation in the next 30 days, higher than 9% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 4.7 AV:L/AC:M/Au:N/C:N/I:N/A:C

Affected products

  • AMD Ryzen 5000 Series

Classification

Weakness
  • CWE-1284 Improper Validation of Specified Quantity in Input

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.