AMD revealed in the most recent January update that thirty-one new vulnerabilities were found in its processors, covering Ryzen and EPYC CPUs.
AMD hit with 31 new vulnerabilities to start 2023, affecting Ryzen & EPYC CPU lines
The company has created numerous mitigations to alleviate the exposed processors and has also disclosed a report from the company in cooperation with teams from three top companies — Apple, Google, and Oracle. The company also announced several AGESA variants listed in the update (AGESA code is found when building the system’s BIOS and UEFI code).
Due to the vulnerability’s nature, the AGESA changes have been delivered to OEMs, and any patching will depend on each vendor to release it as soon as possible. It would be wise for consumers to visit the vendor’s official website to find out if there is a new update waiting for download rather than waiting for the company to roll it out later.
AMD Processors vulnerable to this new attack include Ryzen models for desktops, HEDT, Pro, and mobile CPU series. There is a single vulnerability labeled as “high severity,” while two others are less extreme but still important to patch. All exposures are attacked through the BIOS and ASP bootloader (also known as the AMD Secure Processor bootloader).
AMD CPU series that are vulnerable are:
- Ryzen 2000 (Pinnacle Ridge) series processors
- Ryzen 2000 APUs
- Ryzen 5000 APUs
- AMD Threadripper 2000 HEDT and Pro server processor series
- AMD Threadripper 3000 HEDT and Pro server processor series
- Ryzen 2000 series mobile processors
- Ryzen 3000 series mobile processors
- Ryzen 5000 series mobile processors
- Ryzen 6000 series mobile processors
- Athlon 3000 series mobile processors
Twenty-eight AMD vulnerabilities have been discovered affecting EPYC processors, with four models labeled with a “high severity” by the company. The three of high severity can have arbitrary code that can be executed through attack vectors in numerous areas. Also, one of the three listed has an additional exploit that permits writing data to specific sections leading to data loss. Other research teams found another fifteen vulnerabilities with lower severity and nine with minor severity.
Because of the large number of affected processors exploited, the company chose to disclose this recent vulnerability list that would typically be published in May and November each year and make sure that mitigations were prepared for release. Other vulnerabilities within AMD products include a variant of Hertzbleed, another that acts similarly to the Meltdown exploit, and one called “Take A Way.”
| CVE | Severity | CVE Description |
| CVE‑2021‑26316 | High | Failure to validate the communication buffer and communication service in the BIOS may allow an attacker to tamper with the buffer resulting in potential SMM (System Management Mode) arbitrary code execution. |
| CVE‑2021‑26346 | Medium | Failure to validate the integer operand in ASP (AMD Secure Processor) bootloader may allow an attacker to introduce an integer overflow in the L2 directory table in SPI flash resulting in a potential denial of service. |
| CVE‑2021‑46795 | Low | A TOCTOU (time-of-check to time-of-use) vulnerability exists where an attacker may use a compromised BIOS to cause the TEE OS to read memory out of bounds that could potentially result in a denial of service. |
DESKTOP
| CVE | AMD Ryzen™ 2000 series Desktop Processors “Raven Ridge” AM4 | AMD Ryzen™ 2000 Series Desktop Processors “Pinnacle Ridge” | AMD Ryzen™ 3000 Series Desktop Processors “Matisse” AM4 | AMD Ryzen™ 5000 Series Desktop Processors “Vermeer” AM4 | AMD Ryzen™ 5000 Series Desktop Processor with Radeon™ Graphics “Cezanne” AM4 |
| Minimum version to mitigate all listed CVEs | Raven-FP5-AM4 1.1.0.D ComboAM4PI 1.0.0.8 ComboAM4v2 PI 1.2.0.4 PinnaclePI-AM4 1.0.0.C | PinnaclePI-AM4 1.0.0.C ComboAM4PI 1.0.0.8 ComboAM4v2 PI 1.2.0.4 | N/A | N/A | ComboAM4v2 PI 1.2.0.8 |
| CVE‑2021‑26316 | Raven-FP5-AM4 1.1.0.D ComboAM4PI 1.0.0.8 ComboAM4v2 PI 1.2.0.4 PinnaclePI-AM4 1.0.0.C | PinnaclePI-AM4 1.0.0.C ComboAM4PI 1.0.0.8 ComboAM4v2 PI 1.2.0.4 | N/A | N/A | ComboAM4v2 PI 1.2.0.4 |
| CVE‑2021‑26346 | N/A | N/A | N/A | N/A | ComboAM4v2 PI 1.2.0.8 |
| CVE‑2021‑46795 | N/A | N/A | N/A | N/A | ComboAM4v2 PI 1.2.0.5 |
HIGH END DESKTOP
| CVE | 2nd Gen AMD Ryzen™ Threadripper™ Processors “Colfax” | 3rd Gen AMD Ryzen™ Threadripper™ Processors “Castle Peak” HEDT |
| Minimum version to mitigate all listed CVEs | SummitPI-SP3r2 1.1.0.5 | CastlePeakPI-SP3r3 1.0.0.6 |
| CVE‑2021‑26316 | SummitPI-SP3r2 1.1.0.5 | CastlePeakPI-SP3r3 1.0.0.6 |
| CVE‑2021‑26346 | N/A | N/A |
| CVE‑2021‑46795 | N/A | N/A |
WORKSTATION
| CVE | AMD Ryzen™ Threadripper™ PRO Processors “Castle Peak” WS | AMD Ryzen™ Threadripper™ PRO Processors “Chagall” WS |
| Minimum version to mitigate all listed CVEs | CastlePeakWSPI-sWRX8 1.0.0.7 ChagallWSPI-sWRX8 0.0.9.0 | N/A |
| CVE‑2021‑26316 | CastlePeakWSPI-sWRX8 1.0.0.7 ChagallWSPI-sWRX8 0.0.9.0 | N/A |
| CVE‑2021‑26346 | N/A | N/A |
| CVE‑2021‑46795 | N/A | N/A |
MOBILE – AMD Athlon Series
| CVE | AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics “Dali”/”Dali” ULP | AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics “Pollock” |
| Minimum version to mitigate all listed CVEs | PicassoPI-FP5 1.0.0.D | PollockPI-FT5 1.0.0.3 |
| CVE‑2021‑26316 | PicassoPI-FP5 1.0.0.D | PollockPI-FT5 1.0.0.3 |
| CVE‑2021‑26346 | N/A | N/A |
| CVE‑2021‑46795 | N/A | N/A |
MOBILE – AMD Ryzen Series
| CVE | AMD Ryzen™ 2000 Series Mobile Processors “Raven Ridge” FP5 | AMD Ryzen™ 3000 Series Mobile processor, 2nd Gen AMD Ryzen™ Mobile Processors with Radeon™ Graphics “Picasso” | AMD Ryzen™ 3000 Series Mobile Processors with Radeon™ Graphics “Renoir” FP6 | AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics “Lucienne” | AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics “Cezanne” | AMD Ryzen™ 6000 Series Mobile Processors “Rembrandt” |
| Minimum version to mitigate all listed CVEs | N/A | PicassoPI-FP5 1.0.0.D ComboAM4PI 1.0.0.8 ComboAM4v2 PI 1.2.0.4 | RenoirPI-FP6 1.0.0.9 ComboAM4v2 PI 1.2.0.8 | CezannePI-FP6 1.0.0.B | CezannePI-FP6 1.0.0.B | N/A |
| CVE‑2021‑26316 | N/A | PicassoPI-FP5 1.0.0.D ComboAM4PI 1.0.0.8 ComboAM4v2 PI 1.2.0.4 | RenoirPI-FP6 1.0.0.7 ComboAM4v2 PI 1.2.0.4 | CezannePI-FP6 1.0.0.6 | CezannePI-FP6 1.0.0.6 | N/A |
| CVE‑2021‑26346 | N/A | N/A | RenoirPI-FP6 1.0.0.9 ComboAM4v2 PI 1.2.0.8 | CezannePI-FP6 1.0.0.B | CezannePI-FP6 1.0.0.B | N/A |
| CVE‑2021‑46795 | N/A | N/A | RenoirPI-FP6 1.0.0.7 ComboAM4v2 PI 1.2.0.5 | CezannePI-FP6 1.0.0.6 | CezannePI-FP6 1.0.0.6 | N/A |
News Sources: Tom’s Hardware, AMD Client Vulnerabilities – January 2023, AMD Server Vulnerabilities – January 2023