High WID-SEC-2024-1837 13 CVEs

AMD Prozessoren: Mehrere Schwachstellen

Published Aug 13, 2024 · Updated May 12, 2026 · Revision 10 · de-DE

Vendor: AMD Vendor: Dell Vendor: HP Vendor: IBM Vendor: Oracle Vendor: Red Hat Vendor: Ubuntu Product: Computer Product: Computer Product: Enterprise Linux Product: Linux Product: Linux Product: Power Hardware Management Console Product: PowerEdge Product: Prozessor Product: Radeon Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in AMD Prozessor und AMD Radeon ausnutzen, um beliebigen Programmcode auszuführen, erhöhte Rechte zu erlangen, einen Denial-of-Service-Zustand zu erzeugen, Daten zu manipulieren, Sicherheitsmaßnahmen zu umgehen und vertrauliche Informationen preiszugeben.

Product

Prozessoren sind die zentralen Rechenwerke eines Computers.
Radeon bezeichnet eine Familie von Grafikkarten von AMD.

Vulnerabilities 13

High 7.5

CVE-2022-23815

Improper bounds checking in APCB firmware may allow an attacker to perform an out of bounds write, corrupting the APCB …

AMD AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics AMD Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics AMD Ryzen™ 3000 Series Mobile Processor with Radeon™ Graphics

Aug 13, 2024
High 7.5

CVE-2023-20578

A TOCTOU (Time-Of-Check-Time-Of-Use) in SMM may allow an attacker with ring0 privileges and access to the BIOS menu or …

AMD AMD Ryzen™ 7020 Series Processors with Radeon™ Graphics AMD Ryzen™ 7000 Series Desktop Processors AMD Ryzen™ 6000 Series Processors with Radeon™ Graphics

Aug 13, 2024
High 7.3

CVE-2022-23817

Insufficient checking of memory buffer in AMD Secure Processor (ASP) Secure OS may allow an attacker with a malicious t…

AMD AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics

Aug 13, 2024
High 7.2

CVE-2021-26344

An out of bounds memory write when processing the AMD PSP1 Configuration Block (APCB) could allow an attacker with acce…

AMD AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics AMD Ryzen™ 7020 Series Processors with Radeon™ Graphics

Aug 13, 2024
Medium 6.5

CVE-2023-20591

Improper re-initialization of IOMMU during the DRTM event may permit an untrusted platform configuration to persist, al…

AMD AMD EPYC™ 9004 Series Processors AMD EPYC™ Embedded 7003 Series Processors AMD EPYC™ 7003 Series Processors

Aug 13, 2024
Medium 5.7

CVE-2021-26367

A malicious attacker in x86 can misconfigure the Trusted Memory Regions (TMRs), which may allow the attacker to set an …

AMD AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics

Aug 13, 2024
Medium 5.7

CVE-2024-21981

Improper key usage control in AMD Secure Processor (ASP) may allow an attacker with local access who has gained arbitra…

AMD AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics AMD Ryzen™ 5000 Series Desktop Processors AMD Ryzen™ 3000 Series Desktop Processors

Aug 13, 2024
Medium 5.3

CVE-2023-20584

IOMMU improperly handles certain special address ranges with invalid device table entries (DTEs), which may allow an at…

AMD AMD EPYC™ 9004 Processors AMD EPYC™ 7003 Processors amd64-microcode Debian Ubuntu

Aug 13, 2024
Medium 5.2

CVE-2021-46746

Lack of stack protection exploit mechanisms in ASP Secure OS Trusted Execution Environment (TEE) may allow a privileged…

AMD AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics AMD Ryzen™ 7020 Series Processors with Radeon™ Graphics

Aug 13, 2024
Medium 4.4

CVE-2023-31356

Incomplete system memory cleanup in SEV firmware could allow a privileged attacker to corrupt guest private memory, pot…

AMD AMD EPYC™ Embedded 7003 AMD EPYC™ 9004 Processors AMD EPYC™ Embedded 9004 Debian Ubuntu

Aug 13, 2024
Low 3.9

CVE-2021-26387

Insufficient access controls in ASP kernel may allow a privileged attacker with access to AMD signing keys and the BIOS…

AMD AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics AMD Ryzen™ 7000 Series Desktop Processors

Aug 13, 2024
Low 3.9

CVE-2021-46772

Insufficient input validation in the ABL may allow a privileged attacker with access to the BIOS menu or UEFI shell to …

AMD AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics AMD Ryzen™ 7020 Series Processors with Radeon™ Graphics

Aug 13, 2024
Low 1.9

CVE-2023-20518

Incomplete cleanup in the ASP may expose the Master Encryption Key (MEK) to a privileged attacker with access to the BI…

AMD AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics AMD Ryzen™ 7020 Series Processors with Radeon™ Graphics

Aug 13, 2024

Revision history

2026-05-12 #10
Neue Updates von Dell aufgenommen
2025-08-18 #9
Neue Updates von Dell aufgenommen
2025-06-09 #8
Neue Updates von Ubuntu aufgenommen
2025-02-18 #7
Neue Updates von IBM und IBM-APAR aufgenommen
2024-12-03 #6
Neue Updates von Dell aufgenommen
2024-10-22 #5
Neue Updates von Oracle Linux aufgenommen
2024-10-01 #4
Neue Updates von Red Hat aufgenommen
2024-09-30 #3
Neue Updates von Red Hat aufgenommen
2024-08-20 #2
Neue Updates von HP aufgenommen
2024-08-13 #1
Initiale Fassung

References

AMD Security Bulletin vom 2024-08-13
https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3003.html
AMD Security Bulletin vom 2024-08-13
https://www.amd.com/en/resources/product-security/bulletin/amd-sb-4004.html
AMD Security Bulletin vom 2024-08-13
https://www.amd.com/en/resources/product-security/bulletin/amd-sb-5002.html
AMD Security Bulletin vom 2024-08-13
https://www.amd.com/en/resources/product-security/bulletin/amd-sb-6013.html
HP Security Bulletin HPSBHF03964 vom 2024-08-08
https://support.hp.com/de-de/document/ish_11024058-11038843-16/HPSBHF03964
Red Hat Security Advisory RHSA-2024:7418 vom 2024-10-01
https://access.redhat.com/errata/RHSA-2024:7418
Red Hat Security Advisory RHSA-2024:7482 vom 2024-10-02
https://access.redhat.com/errata/RHSA-2024:7482
Red Hat Security Advisory RHSA-2024:7481 vom 2024-10-02
https://access.redhat.com/errata/RHSA-2024:7481
Red Hat Security Advisory RHSA-2024:7483 vom 2024-10-02
https://access.redhat.com/errata/RHSA-2024:7483
Red Hat Security Advisory RHSA-2024:7484 vom 2024-10-02
https://access.redhat.com/errata/RHSA-2024:7484
Oracle Linux Security Advisory ELSA-2024-12797 vom 2024-10-23
https://linux.oracle.com/errata/ELSA-2024-12797.html
Dell Security Advisory DSA-2024-307 vom 2024-12-03
https://www.dell.com/support/kbdoc/de-de/000256080/dsa-2024-307-security-update-for-dell-amd-based-gpu-vulnerabilities
IBM Security Bulletin 7183573 vom 2025-02-18
https://www.ibm.com/support/pages/node/7183573
Ubuntu Security Notice USN-7561-1 vom 2025-06-09
https://ubuntu.com/security/notices/USN-7561-1
Dell Security Advisory DSA-2024-051 vom 2025-08-18
https://www.dell.com/support/kbdoc/de-de/000221360/dsa-2024-051
Dell Security Advisory DSA-2026-216 vom 2026-05-12
https://www.dell.com/support/kbdoc/de-de/000464072/dsa-2026-216-security-update-for-dell-amd-based-graphics-driver-vulnerabilities