{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-21981", "assignerOrgId": "b58fc414-a1e4-4f92-9d70-1add41838648", "state": "PUBLISHED", "assignerShortName": "AMD", "dateReserved": "2024-01-03T16:43:30.197Z", "datePublished": "2024-08-13T16:54:58.122Z", "dateUpdated": "2024-08-15T18:09:24.358Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "packageName": "PI", "product": "AMD EPYC\u2122 7001 Series Processors", "vendor": "AMD", "versions": [{"status": "affected", "version": "various", "versionType": "PI"}]}, {"defaultStatus": "affected", "product": "AMD EPYC\u2122 7002 Series Processors", "vendor": "AMD", "versions": [{"status": "affected", "version": "various"}]}, {"defaultStatus": "affected", "product": "AMD EPYC\u2122 7003 Series Processors", "vendor": "AMD", "versions": [{"status": "affected", "version": "various"}]}, {"defaultStatus": "affected", "product": "AMD Ryzen\u2122 3000 Series Desktop Processors", "vendor": "AMD", "versions": [{"status": "affected", "version": "various"}]}, {"defaultStatus": "affected", "product": "AMD Ryzen\u2122 5000 Series Desktop Processors", "vendor": "AMD", "versions": [{"status": "affected", "version": "various"}]}, {"defaultStatus": "affected", "product": "AMD Ryzen\u2122 5000 Series Desktop Processor with Radeon\u2122 Graphics", "vendor": "AMD", "versions": [{"status": "affected", "version": "various"}]}, {"defaultStatus": "affected", "product": "AMD Athlon\u2122 3000 Series Desktop Processors with Radeon\u2122 Graphics", "vendor": "AMD", "versions": [{"status": "affected", "version": "various"}]}, {"defaultStatus": "affected", "product": "AMD Ryzen\u2122 4000 Series Desktop Processors with Radeon\u2122 Graphics", "vendor": "AMD", "versions": [{"status": "affected", "version": "various"}]}, {"defaultStatus": "affected", "product": "AMD Ryzen\u2122 Threadripper\u2122 3000 Series Processors", "vendor": "AMD", "versions": [{"status": "affected", "version": "various"}]}, {"defaultStatus": "affected", "product": "AMD Ryzen\u2122 Threadripper\u2122 PRO 3000WX Series Processors", "vendor": "AMD", "versions": [{"status": "affected", "version": "various"}]}, {"defaultStatus": "affected", "product": "AMD Ryzen\u2122 Threadripper\u2122 PRO 5000WX Processors", "vendor": "AMD", "versions": [{"status": "affected", "version": "various"}]}, {"defaultStatus": "affected", "product": "AMD Athlon\u2122 3000 Series Mobile Processors with Radeon\u2122 Graphics", "vendor": "AMD", "versions": [{"status": "affected", "version": "various"}]}, {"defaultStatus": "affected", "product": "AMD Athlon\u2122 3000 Series Mobile Processors with Radeon\u2122 Graphics", "vendor": "AMD", "versions": [{"status": "affected", "version": "various"}]}, {"defaultStatus": "affected", "product": "AMD Ryzen\u2122 3000 Series Mobile Processor with Radeon\u2122 Graphics", "vendor": "AMD", "versions": [{"status": "affected", "version": "various"}]}, {"defaultStatus": "affected", "product": "AMD EPYC\u2122 Embedded 3000 Series Processors", "vendor": "AMD", "versions": [{"status": "affected", "version": "various"}]}, {"defaultStatus": "affected", "product": "AMD EPYC\u2122 Embedded 7002 Series Processors", "vendor": "AMD", "versions": [{"status": "affected", "version": "various"}]}, {"defaultStatus": "affected", "product": "AMD EPYC\u2122 Embedded 7003 Series Processors", "vendor": "AMD", "versions": [{"status": "affected", "version": "various"}]}, {"defaultStatus": "affected", "product": "AMD Ryzen\u2122 Embedded R1000 Series Processors", "vendor": "AMD", "versions": [{"status": "affected", "version": "various"}]}, {"defaultStatus": "affected", "product": "AMD Ryzen\u2122 Embedded R2000 Series Processors", "vendor": "AMD", "versions": [{"status": "affected", "version": "various"}]}, {"defaultStatus": "affected", "product": "AMD Ryzen\u2122 Embedded 5000 Series Processors", "vendor": "AMD", "versions": [{"status": "affected", "version": "various"}]}, {"defaultStatus": "affected", "product": "AMD Ryzen\u2122 Embedded V1000 Series Processors", "vendor": "AMD", "versions": [{"status": "affected", "version": "various"}]}], "datePublic": "2024-08-13T16:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">Improper key usage control in AMD Secure Processor\n(ASP) may allow an attacker with local access <a target=\"_blank\" rel=\"nofollow\"></a><a target=\"_blank\" rel=\"nofollow\"></a><a target=\"_blank\" rel=\"nofollow\"></a><a target=\"_blank\" rel=\"nofollow\">who has gained arbitrary code\nexecution privilege in ASP&nbsp;</a>to\nextract ASP cryptographic keys, potentially resulting in loss of\nconfidentiality and integrity.\n\n<div>\n\n\n\n\n\n<div>\n\n<div><a target=\"_blank\" rel=\"nofollow\"></a>\n\n<p><br></p></div></div><div><div>\n\n</div>\n\n</div>\n\n</div>\n\n\n\n\n\n<div><div><div>\n\n</div>\n\n</div>\n\n</div>\n\n\n\n\n\n</span>"}], "value": "Improper key usage control in AMD Secure Processor\n(ASP) may allow an attacker with local access who has gained arbitrary code\nexecution privilege in ASP\u00a0to\nextract ASP cryptographic keys, potentially resulting in loss of\nconfidentiality and integrity."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "providerMetadata": {"orgId": "b58fc414-a1e4-4f92-9d70-1add41838648", "shortName": "AMD", "dateUpdated": "2024-08-13T16:54:58.122Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3003.html"}], "source": {"advisory": "AMD-SB-4002, AMD-SB-3002, AMD-SB-5001", "discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-639", "lang": "en", "description": "CWE-639 Authorization Bypass Through User-Controlled Key"}]}], "affected": [{"vendor": "amd", "product": "athlon", "cpes": ["cpe:2.3:h:amd:athlon:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "*", "versionType": "custom"}]}, {"vendor": "amd", "product": "ryzen", "cpes": ["cpe:2.3:h:amd:ryzen:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "*", "versionType": "custom"}]}, {"vendor": "amd", "product": "epyc", "cpes": ["cpe:2.3:h:amd:epyc:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "*", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-08-15T17:56:59.454756Z", "id": "CVE-2024-21981", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-15T18:09:24.358Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-21981", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-08-15T17:56:59.454756Z"}}}], "affected": [{"cpes": ["cpe:2.3:h:amd:athlon:-:*:*:*:*:*:*:*"], "vendor": "amd", "product": "athlon", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:amd:ryzen:-:*:*:*:*:*:*:*"], "vendor": "amd", "product": "ryzen", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:amd:epyc:-:*:*:*:*:*:*:*"], "vendor": "amd", "product": "epyc", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639 Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-14T20:36:30.773Z"}}], "cna": {"source": {"advisory": "AMD-SB-4002, AMD-SB-3002, AMD-SB-5001", "discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "AMD", "product": "AMD EPYC\u2122 7001 Series Processors", "versions": [{"status": "affected", "version": "various", "versionType": "PI"}], "packageName": "PI", "defaultStatus": "affected"}, {"vendor": "AMD", "product": "AMD EPYC\u2122 7002 Series Processors", "versions": [{"status": "affected", "version": "various"}], "defaultStatus": "affected"}, {"vendor": "AMD", "product": "AMD EPYC\u2122 7003 Series Processors", "versions": [{"status": "affected", "version": "various"}], "defaultStatus": "affected"}, {"vendor": "AMD", "product": "AMD Ryzen\u2122 3000 Series Desktop Processors", "versions": [{"status": "affected", "version": "various"}], "defaultStatus": "affected"}, {"vendor": "AMD", "product": "AMD Ryzen\u2122 5000 Series Desktop Processors", "versions": [{"status": "affected", "version": "various"}], "defaultStatus": "affected"}, {"vendor": "AMD", "product": "AMD Ryzen\u2122 5000 Series Desktop Processor with Radeon\u2122 Graphics", "versions": [{"status": "affected", "version": "various"}], "defaultStatus": "affected"}, {"vendor": "AMD", "product": "AMD Athlon\u2122 3000 Series Desktop Processors with Radeon\u2122 Graphics", "versions": [{"status": "affected", "version": "various"}], "defaultStatus": "affected"}, {"vendor": "AMD", "product": "AMD Ryzen\u2122 4000 Series Desktop Processors with Radeon\u2122 Graphics", "versions": [{"status": "affected", "version": "various"}], "defaultStatus": "affected"}, {"vendor": "AMD", "product": "AMD Ryzen\u2122 Threadripper\u2122 3000 Series Processors", "versions": [{"status": "affected", "version": "various"}], "defaultStatus": "affected"}, {"vendor": "AMD", "product": "AMD Ryzen\u2122 Threadripper\u2122 PRO 3000WX Series Processors", "versions": [{"status": "affected", "version": "various"}], "defaultStatus": "affected"}, {"vendor": "AMD", "product": "AMD Ryzen\u2122 Threadripper\u2122 PRO 5000WX Processors", "versions": [{"status": "affected", "version": "various"}], "defaultStatus": "affected"}, {"vendor": "AMD", "product": "AMD Athlon\u2122 3000 Series Mobile Processors with Radeon\u2122 Graphics", "versions": [{"status": "affected", "version": "various"}], "defaultStatus": "affected"}, {"vendor": "AMD", "product": "AMD Athlon\u2122 3000 Series Mobile Processors with Radeon\u2122 Graphics", "versions": [{"status": "affected", "version": "various"}], "defaultStatus": "affected"}, {"vendor": "AMD", "product": "AMD Ryzen\u2122 3000 Series Mobile Processor with Radeon\u2122 Graphics", "versions": [{"status": "affected", "version": "various"}], "defaultStatus": "affected"}, {"vendor": "AMD", "product": "AMD EPYC\u2122 Embedded 3000 Series Processors", "versions": [{"status": "affected", "version": "various"}], "defaultStatus": "affected"}, {"vendor": "AMD", "product": "AMD EPYC\u2122 Embedded 7002 Series Processors", "versions": [{"status": "affected", "version": "various"}], "defaultStatus": "affected"}, {"vendor": "AMD", "product": "AMD EPYC\u2122 Embedded 7003 Series Processors", "versions": [{"status": "affected", "version": "various"}], "defaultStatus": "affected"}, {"vendor": "AMD", "product": "AMD Ryzen\u2122 Embedded R1000 Series Processors", "versions": [{"status": "affected", "version": "various"}], "defaultStatus": "affected"}, {"vendor": "AMD", "product": "AMD Ryzen\u2122 Embedded R2000 Series Processors", "versions": [{"status": "affected", "version": "various"}], "defaultStatus": "affected"}, {"vendor": "AMD", "product": "AMD Ryzen\u2122 Embedded 5000 Series Processors", "versions": [{"status": "affected", "version": "various"}], "defaultStatus": "affected"}, {"vendor": "AMD", "product": "AMD Ryzen\u2122 Embedded V1000 Series Processors", "versions": [{"status": "affected", "version": "various"}], "defaultStatus": "affected"}], "datePublic": "2024-08-13T16:00:00.000Z", "references": [{"url": "https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3003.html", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "Improper key usage control in AMD Secure Processor\n(ASP) may allow an attacker with local access who has gained arbitrary code\nexecution privilege in ASP\u00a0to\nextract ASP cryptographic keys, potentially resulting in loss of\nconfidentiality and integrity.", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">Improper key usage control in AMD Secure Processor\n(ASP) may allow an attacker with local access <a target=\"_blank\" rel=\"nofollow\"></a><a target=\"_blank\" rel=\"nofollow\"></a><a target=\"_blank\" rel=\"nofollow\"></a><a target=\"_blank\" rel=\"nofollow\">who has gained arbitrary code\nexecution privilege in ASP&nbsp;</a>to\nextract ASP cryptographic keys, potentially resulting in loss of\nconfidentiality and integrity.\n\n<div>\n\n\n\n\n\n<div>\n\n<div><a target=\"_blank\" rel=\"nofollow\"></a>\n\n<p><br></p></div></div><div><div>\n\n</div>\n\n</div>\n\n</div>\n\n\n\n\n\n<div><div><div>\n\n</div>\n\n</div>\n\n</div>\n\n\n\n\n\n</span>", "base64": false}]}], "providerMetadata": {"orgId": "b58fc414-a1e4-4f92-9d70-1add41838648", "shortName": "AMD", "dateUpdated": "2024-08-13T16:54:58.122Z"}}}, "cveMetadata": {"cveId": "CVE-2024-21981", "state": "PUBLISHED", "dateUpdated": "2024-08-15T18:09:24.358Z", "dateReserved": "2024-01-03T16:43:30.197Z", "assignerOrgId": "b58fc414-a1e4-4f92-9d70-1add41838648", "datePublished": "2024-08-13T16:54:58.122Z", "assignerShortName": "AMD"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Improper key usage control in AMD Secure Processor\n(ASP) may allow an attacker with local access who has gained arbitrary code\nexecution privilege in ASP\u00a0to\nextract ASP cryptographic keys, potentially resulting in loss of\nconfidentiality and integrity."}, {"lang": "es", "value": "Un control inadecuado del uso de claves en el procesador seguro AMD (ASP) puede permitir que un atacante con acceso local que haya obtenido privilegios de ejecuci\u00f3n de c\u00f3digo arbitrario en ASP extraiga claves criptogr\u00e1ficas ASP, lo que podr\u00eda provocar una p\u00e9rdida de confidencialidad e integridad."}], "id": "CVE-2024-21981", "lastModified": "2024-08-15T18:35:06.310", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 0.5, "impactScore": 5.2, "source": "psirt@amd.com", "type": "Secondary"}]}, "published": "2024-08-13T17:15:22.920", "references": [{"source": "psirt@amd.com", "url": "https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3003.html"}], "sourceIdentifier": "psirt@amd.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}