Hugo Magalhaes

The issue is related to improper key usage control in the AMD Secure Processor (ASP), which may allow an attacker with local access and arbitrary code execution privilege in ASP to extract ASP cryptographic keys. This could result in loss of confidentiality and integrity.

The issue is related to a vulnerability in the NVIDIA ConnectX Host Firmware for the BlueField Data Processing Unit, where a restricted host may cause an incorrect user management error, potentially leading to escalation of privileges.

The issue is related to improper access controls, which allows the OS to reinitialize a disabled root complex.

The issue is related to a buffer overflow in the memory of AMD processor security microcode, potentially allowing a remote attacker to disclose protected information. It involves the failure to validate addresses provided by software to BIOS commands, which may result in a potential loss of integrity of guest memory in a confidential compute environment.

The issue is related to insufficient bounds checking in the AMD Secure Processor firmware when handling BIOS mailbox commands. This can allow an attacker to write partially-controlled data out-of-bounds to SMM or SEV-ES regions, potentially leading to a loss of integrity and availability of protected information.

The Altra reference design of UEFI accesses allows insecure access to SPI-NOR by the OS/hypervisor component.

The issue is related to improper access control in the BIOS authenticated code module for some Intel Processors. This may allow a privileged user to potentially enable escalation of privilege via local access.

A potential issue in AMD System Management Mode (SMM) interrupt handler may allow an attacker with high privileges to access the SMM, resulting in arbitrary code execution. This could be used by malicious actors to bypass security mechanisms provided in the UEFI firmware. The issue may allow escalation of privilege and arbitrary code execution in UEFI firmware (BIOS) for some PC products.

The issue is related to an unchecked return value in the firmware for some Intel(R) Processors. This may allow a privileged user to potentially enable escalation of privilege via local access.

A NULL pointer dereference issue in the firmware of some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.

A buffer overflow issue in the firmware of some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.

The issue concerns pointer problems in the firmware of some Intel(R) Processors. This could potentially allow a privileged user to escalate their privileges via local access.

The issue is related to an out-of-bounds read in the firmware for some Intel(R) Processors. This may allow a privileged user to potentially enable an escalation of privilege via local access.

A potential weakness in AMD SPI protection features may allow a malicious attacker with Ring0 (kernel mode) access to bypass the native System Management Mode (SMM) ROM protections. This issue is related to insufficient protection of service data and may allow an attacker to bypass security restrictions, elevate privileges, or execute arbitrary code. The flaw potentially impacts millions of devices worldwide.

A potential issue exists in the AMD Platform Security Processor (PSP) that may allow an attacker to zero any privileged register on the System Management Network, which may lead to bypassing SPI ROM protections.

The issue is related to a side effect of an integrated chipset option that can be exploited by an attacker to bypass SPI ROM protections, allowing unauthorized modification of the SPI ROM. This is due to errors in the integrated chipset. The exploitation of this issue can enable an attacker to circumvent the SPI ROM protection mechanism, potentially leading to data modification.

Name of the Vulnerable Software and Affected Versions: Intel(R) Processors (affected versions not specified) Description: The issue is related to an unchecked return value in the firmware for some Intel(R) Processors and insecure default variable initialization for the Intel BSSA DFT feature. This may allow a privileged user to potentially enable an escalation of privilege via local access. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to insecure default variable initialization for the Intel BSSA DFT feature, which may allow a privileged user to potentially enable an escalation of privilege via local access. This is due to errors in the initialization of variables.

The issue is related to an out-of-bounds write in the BIOS authenticated code module for some Intel(R) Processors. This may allow a privileged user to potentially enable escalation of privilege via local access. The vulnerability is associated with a buffer overflow in the Authenticated Code Module (ACM) of the BIOS firmware.