AMD Chipset Driver flaw allows obtaining sensitive data

guest · Sep 18, 2021

CVE-2021-26333 AMD Chipset Driver flaw allows obtaining sensitive data
Chipmaker AMD has addressed a vulnerability in PSP driver
September 17, 2021
https://securityaffairs.co/wordpress/122330/security/amd-driver-vulnerability.html

Chipmaker AMD has addressed a medium severity issue in Platform Security Processor (PSP) chipset driver, tracked as CVE-2021-26333, that could allow an attacker to obtain sensitive information from the targeted system.

The vulnerability is an information disclosure issue, an attacker can trigger it by sending requests to the driver resulting in a potential data leak from uninitialized physical pages.
Click to expand...

The flaw was reported by Kyriakos Economou from ZeroPeril.

“We recently discovered a critical information disclosure vulnerability that affected the AMD Platform Security Processor (PSP) chipset driver for multiple CPU architectures.” reads the security advisory. “The vulnerability allowed non-privileged users to read uninitialised physical memory pages, where the original data was either moved or paged out.”
ZeroPeril has discovered two issues in the amdpsp.sys (v4.13.0.0) kernel driver module that ships with AMD Chipset Drivers package for multiple AMD chipsets. The second issue reported by ZeroPeril is a memory leak type bug.
Click to expand...

AMD has released PSP driver version 3.08.17.735 to fix both issues, the AMD Chipset Drivers package for the following AMD chipsets have been impacted [...]

AMD also published its own advisory about this vulnerability.
Click to expand...

Log in or Sign up

AMD Chipset Driver flaw allows obtaining sensitive data

guest Guest

Log in or Sign up

AMD Chipset Driver flaw allows obtaining sensitive data

guest Guest

Useful Searches