SB2023120820 - SUSE update for kernel-firmware
Published: December 8, 2023
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 11 secuirty vulnerabilities.
1) Out-of-bounds read (CVE-ID: CVE-2021-26345)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary condition in APCB. A local user can trigger an out-of-bounds read error and perform a denial of service (DoS) attack.
2) Incomplete cleanup (CVE-ID: CVE-2021-46766)
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to incomplete clearing of sensitive data in the ASP Bootloader. A local user with access to ASP SRAM can gain access to sensitive information.
3) Out-of-bounds write (CVE-ID: CVE-2021-46774)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error when processing DRAM address in System
Management Unit (SMU). A local user can trigger an out-of-bounds write and perform a denial of service (DoS) attack.
4) Buffer overflow (CVE-ID: CVE-2022-23820)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to improper validation of the AMD SMM communication buffer. A local user can corrupt the SMRAM and execute arbitrary code on the system.
5) Configuration (CVE-ID: CVE-2022-23830)
The issue may allow a local user to bypass implemented security restrictions.
The issue exists due to immutable SMM configuration when SNP is enabled. A local user can modify guest memory.
6) Use-after-free (CVE-ID: CVE-2023-20519)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to a use-after-free error in the management of an SNP guest context page. A malicious hypervisor can masquerade as the guest's migration agent and perform a denial of service (DoS) attack.
7) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2023-20521)
The vulnerability allows an attacker to perform a denial of service attack.
The vulnerability exists due to a race condition in ASP Bootloader. An attacker with physical access to device can tamper with SPI ROM records after memory content verification and gain access to sensitive information of perform a denial of service (DoS) attack.
8) Input validation error (CVE-ID: CVE-2023-20526)
The vulnerability allows an attacker to gain access to sensitive information.
The vulnerability exists due to insufficient validation of user-supplied input in the ASP Bootloader. An attacker with physical access to device can read contents of ASP memory.
9) Out-of-bounds write (CVE-ID: CVE-2023-20533)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
10) Input validation error (CVE-ID: CVE-2023-20566)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to insufficient validation of user-supplied input n ASP with SNP enabled. A local user can compromise guest memory integrity.
11) Reliance on undefined behavior (CVE-ID: CVE-2023-20592)
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to unexpected behavior of the INVD instruction in some AMD CPUs. A malicious hypervisor can affect cache line write-back behavior of the CPU and modify guest virtual machine (VM) memory.
Remediation
Install update from vendor's website.