Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2021-26406

Insufficient validation in parsing Owner's Certificate Authority (OCA) certificates in SEV (AMD Secure Encrypted Virtualization) and SEV-ES user application can lead to a host crash potentially resulting in denial of service.

Security Impact Summary

This vulnerability carries a HIGH severity rating with a CVSS v3.1 score of 7.5, indicating it can be exploited remotely over the network with relatively low complexity without requiring user interaction and does not require pre-existing privileges . The vulnerability impacts and availability (service disruption) for affected systems. Impacting 80 products from amd, from amd, from amd and 77 others, organizations running these solutions should prioritize assessment and patching.

Historical Context

Reported in 2023, this vulnerability emerged during an era marked by increased sophistication in supply chain attacks, cloud infrastructure vulnerabilities, and software-as-a-service (SaaS) security challenges. Security practices during this period emphasized zero-trust architectures, container security, and API protection.

Published

2023-05-09T19:15:10.943

Last Modified

2025-01-28T16:15:30.307

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.5 (HIGH)

Weaknesses
  • Type: Primary
    NVD-CWE-noinfo
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System amd epyc_7232p_firmware romepi_1.0.0.a Yes
Hardware amd epyc_7232p - No
Operating System amd epyc_7252_firmware romepi_1.0.0.a Yes
Hardware amd epyc_7252 - No
Operating System amd epyc_7262_firmware romepi_1.0.0.a Yes
Hardware amd epyc_7262 - No
Operating System amd epyc_7272_firmware romepi_1.0.0.a Yes
Hardware amd epyc_7272 - No
Operating System amd epyc_7282_firmware romepi_1.0.0.a Yes
Hardware amd epyc_7282 - No
Operating System amd epyc_7302_firmware romepi_1.0.0.a Yes
Hardware amd epyc_7302 - No
Operating System amd epyc_7302p_firmware romepi_1.0.0.a Yes
Hardware amd epyc_7302p - No
Operating System amd epyc_7352_firmware romepi_1.0.0.a Yes
Hardware amd epyc_7352 - No
Operating System amd epyc_7402_firmware romepi_1.0.0.a Yes
Hardware amd epyc_7402 - No
Operating System amd epyc_7402p_firmware romepi_1.0.0.a Yes
Hardware amd epyc_7402p - No
Operating System amd epyc_7452_firmware romepi_1.0.0.a Yes
Hardware amd epyc_7452 - No
Operating System amd epyc_7502_firmware romepi_1.0.0.a Yes
Hardware amd epyc_7502 - No
Operating System amd epyc_7502p_firmware romepi_1.0.0.a Yes
Hardware amd epyc_7502p - No
Operating System amd epyc_7532_firmware romepi_1.0.0.a Yes
Hardware amd epyc_7532 - No
Operating System amd epyc_7542_firmware romepi_1.0.0.a Yes
Hardware amd epyc_7542 - No
Operating System amd epyc_7552_firmware romepi_1.0.0.a Yes
Hardware amd epyc_7552 - No
Operating System amd epyc_7642_firmware romepi_1.0.0.a Yes
Hardware amd epyc_7642 - No
Operating System amd epyc_7662_firmware romepi_1.0.0.a Yes
Hardware amd epyc_7662 - No
Operating System amd epyc_7702_firmware romepi_1.0.0.a Yes
Hardware amd epyc_7702 - No
Operating System amd epyc_7702p_firmware romepi_1.0.0.a Yes
Hardware amd epyc_7702p - No
Operating System amd epyc_7742_firmware romepi_1.0.0.a Yes
Hardware amd epyc_7742 - No
Operating System amd epyc_7f32_firmware romepi_1.0.0.a Yes
Hardware amd epyc_7f32 - No
Operating System amd epyc_7f52_firmware romepi_1.0.0.a Yes
Hardware amd epyc_7f52 - No
Operating System amd epyc_7f72_firmware romepi_1.0.0.a Yes
Hardware amd epyc_7f72 - No
Operating System amd epyc_7h12_firmware romepi_1.0.0.a Yes
Hardware amd epyc_7h12 - No
Operating System amd epyc_7251_firmware naplespi_1.0.0.e Yes
Hardware amd epyc_7251 - No
Operating System amd epyc_7261_firmware naplespi_1.0.0.e Yes
Hardware amd epyc_7261 - No
Operating System amd epyc_7281_firmware naplespi_1.0.0.e Yes
Hardware amd epyc_7281 - No
Operating System amd epyc_7301_firmware naplespi_1.0.0.e Yes
Hardware amd epyc_7301 - No
Operating System amd epyc_7351_firmware naplespi_1.0.0.e Yes
Hardware amd epyc_7351 - No
Operating System amd epyc_7351p_firmware naplespi_1.0.0.e Yes
Hardware amd epyc_7351p - No
Operating System amd epyc_7371_firmware naplespi_1.0.0.e Yes
Hardware amd epyc_7371 - No
Operating System amd epyc_7401_firmware naplespi_1.0.0.e Yes
Hardware amd epyc_7401 - No
Operating System amd epyc_7401p_firmware naplespi_1.0.0.e Yes
Hardware amd epyc_7401p - No
Operating System amd epyc_7451_firmware naplespi_1.0.0.e Yes
Hardware amd epyc_7451 - No
Operating System amd epyc_7501_firmware naplespi_1.0.0.e Yes
Hardware amd epyc_7501 - No
Operating System amd epyc_7551_firmware naplespi_1.0.0.e Yes
Hardware amd epyc_7551 - No
Operating System amd epyc_7551p_firmware naplespi_1.0.0.e Yes
Hardware amd epyc_7551p - No
Operating System amd epyc_7571_firmware naplespi_1.0.0.e Yes
Hardware amd epyc_7571 - No
Operating System amd epyc_7601_firmware naplespi_1.0.0.e Yes
Hardware amd epyc_7601 - No
References

How SecUtils Interprets This CVE

SecUtils normalizes and enriches National Vulnerability Database (NVD) records by standardizing vendor and product identifiers, aggregating vulnerability metadata from both NVD and MITRE sources, and providing structured context for security teams. For amd's affected products, we extract Common Platform Enumeration (CPE) data, Common Weakness Enumeration (CWE) classifications, CVSS severity metrics, and reference data to enable rapid vulnerability prioritization and asset correlation. This record contains no exploit code, proof-of-concept instructions, or attack methodologies—only defensive intelligence necessary for patch management, risk assessment, and security operations.