GPU VulnDB

Database/Control plane, storage & DevOps

AMD EPYC Server - protected memory region access control: Insufficient access control over protected memory regions on

CVSS 9.0CVE-2018-8933Control plane, storage & DevOpsFALLOUT-1FALLOUT-2FALLOUT-3curated

Impact

Insufficient access control over protected memory regions on EPYC server parts lets privileged code read and write memory that the platform reserves for security purposes - including regions used by SMM and the secure processor. An attacker uses it to get persistence and to reach data the hardware was supposed to fence off from the OS entirely.

Who can reach it

Local, requires administrator privilege on the host. EPYC server silicon specifically, which is what makes this batch relevant to a datacenter rather than a desktop.

What to do

Fixed in AMD reference firmware (AGESA / PSP / SEV firmware) and delivered only as an OEM SBIOS/BIOS package - Dell, HPE, Supermicro, Lenovo and the ODMs each rebuild and requalify AMD's AGESA drop before shipping. **Expect one to six months of OEM lag**, and on end-of-support platforms expect nothing. Applying it is a drain plus full power cycle, not a driver reload. Verify by reading back the PSP/SMU firmware version afterwards rather than trusting the BIOS version string.

References

https://nvd.nist.gov/vuln/detail/CVE-2018-8933https://www.amd.com/en/resources/product-security.html

Related entries

All Control plane, storage & DevOps entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.