Back to the CVE list
CVE-2021-39298

Improper privilege management in AMD 2nd Gen EPYC

CVSS score

6.5

EPSS probability

%0.4

Risk score

0.0

Published

4 y ago

OverviewPublic Exploits (0)NewsroomVulnerability Timeline
Patch status has not yet been verified

Resmî kaynaklarda yeterli kanıt bulunamadı. Bu sonuç “yama yok” anlamına gelmez.

Impact on My Inventory

Only the personal products you have added to your account are assessed; an organisation's inventory does not appear here.

Checking session…

Vulnerability description

DayBreach CVE AI Research

CVE-2021-39298 has vendor, distribution, patch and security-source records on file. We can compare them and prepare an explanation linked to the evidence.

A potential vulnerability in AMD System Management Mode (SMM) interrupt handler may allow an attacker with high privileges to access the SMM resulting in arbitrary code execution which could be used by malicious actors to bypass security mechanisms provided in the UEFI firmware.

IMPACT: Affected Products and Software

Affected Products

The following products are affected by CVE-2021-39298 vulnerability. Where our threat engine knows the exact affected versions, they are listed below.

IDVENDORPRODUCTACTION
1amd2nd Gen EPYC View
2amd3rd Gen EPYC View
3amdRyzen 2000 Series View
4amdRyzen 3000 Series View
5amdRyzen 5000 Series View
6hpz1 entry tower g5 workstation firmware View
7hpz1 entry tower g5 workstation View
8hpz1 entry tower g6 workstation firmware View
9hpz1 entry tower g6 workstation View
10hpz1 g8 tower desktop pc firmware View
11hpz1 g8 tower desktop pc View
12hpz4 g4 workstation (core-x) firmware View
13hpz4 g4 workstation (core-x) View
14hpz4 g4 workstation (xeon w) firmware View
15hpz4 g4 workstation (xeon w) View
16hpz6 g4 workstation firmware View
17hpz6 g4 workstation View
18hpz8 g4 workstation firmware View
19hpz8 g4 workstation View
20hpengage flex mini retail system firmware View
21hpengage flex mini retail system View
22hpmp9 g4 retail system firmware View
23hpmp9 g4 retail system View
24hpelite dragonfly firmware View
25hpelite dragonfly View
26hpelite dragonfly g2 firmware View
27hpelite dragonfly g2 View
28hpelite dragonfly max firmware View
29hpelite dragonfly max View
30hpelite x2 1013 g3 firmware View
31hpelite x2 1013 g3 View
32hpelite x2 g4 firmware View
33hpelite x2 g4 View
34hpelite x2 g8 tablet firmware View
35hpelite x2 g8 tablet View
36hpelitebook 1050 g1 firmware View
37hpelitebook 1050 g1 View
38hpelitebook 830 g5 firmware View
39hpelitebook 830 g5 View
40hpelitebook 830 g6 firmware View
41hpelitebook 830 g6 View
42hpelitebook 830 g7 firmware View
43hpelitebook 830 g7 View
44hpelitebook 830 g8 firmware View
45hpelitebook 830 g8 View
46hpelitebook 836 g5 firmware View
47hpelitebook 836 g5 View
48hpelitebook 836 g6 firmware View
49hpelitebook 836 g6 View
50hpelitebook 840 aero g8 firmware View
51hpelitebook 840 aero g8 View
52hpelitebook 840 g5 firmware View
53hpelitebook 840 g5 View
54hpelitebook 840 g5 healthcare edition firmware View
55hpelitebook 840 g5 healthcare edition View
56hpelitebook 840 g6 firmware View
57hpelitebook 840 g6 View
58hpelitebook 840 g6 healthcare edition firmware View
59hpelitebook 840 g6 healthcare edition View
60hpelitebook 840 g7 firmware View
61hpelitebook 840 g7 View
62hpelitebook 840 g8 firmware View
63hpelitebook 840 g8 View
64hpelitebook 840r g4 firmware View
65hpelitebook 840r g4 View
66hpelitebook 846 g5 firmware View
67hpelitebook 846 g5 View
68hpelitebook 850 g5 firmware View
69hpelitebook 850 g5 View
70hpelitebook 850 g6 firmware View
71hpelitebook 850 g6 View
72hpelitebook 850 g7 firmware View
73hpelitebook 850 g7 View
74hpelitebook 850 g8 firmware View
75hpelitebook 850 g8 View
76hpelitebook x360 1030 g3 firmware View
77hpelitebook x360 1030 g3 View
78hpelitebook x360 1030 g4 firmware View
79hpelitebook x360 1030 g4 View
80hpelitebook x360 1030 g7 firmware View
81hpelitebook x360 1030 g7 View
82hpelitebook x360 1030 g8 firmware View
83hpelitebook x360 1030 g8 View
84hpelitebook x360 1040 g5 firmware View
85hpelitebook x360 1040 g5 View
86hpelitebook x360 1040 g6 firmware View
87hpelitebook x360 1040 g6 View
88hpelitebook x360 1040 g7 firmware View
89hpelitebook x360 1040 g7 View
90hpelitebook x360 1040 g8 firmware View
91hpelitebook x360 1040 g8 View
92hpelitebook x360 830 g5 firmware View
93hpelitebook x360 830 g5 View
94hpelitebook x360 830 g6 firmware View
95hpelitebook x360 830 g6 View
96hpelitebook x360 830 g7 firmware View
97hpelitebook x360 830 g7 View
98hpelitebook x360 830 g8 firmware View
99hpelitebook x360 830 g8 View
100hpprobook 430 g5 firmware View
101hpprobook 430 g5 View
102hpprobook 430 g6 firmware View
103hpprobook 430 g6 View
104hpprobook 430 g7 firmware View
105hpprobook 430 g7 View
106hpprobook 430 g8 firmware View
107hpprobook 430 g8 View
108hpprobook 440 g5 firmware View
109hpprobook 440 g5 View
110hpprobook 440 g6 firmware View
111hpprobook 440 g6 View
112hpprobook 440 g7 firmware View
113hpprobook 440 g7 View
114hpprobook 440 g8 firmware View
115hpprobook 440 g8 View
116hpprobook 450 g5 firmware View
117hpprobook 450 g5 View
118hpprobook 450 g6 firmware View
119hpprobook 450 g6 View
120hpprobook 450 g7 firmware View
121hpprobook 450 g7 View
122hpprobook 450 g8 firmware View
123hpprobook 450 g8 View
124hpprobook 470 g5 firmware View
125hpprobook 470 g5 View
126hpprobook 630 g8 firmware View
127hpprobook 630 g8 View
128hpprobook 640 g4 firmware View
129hpprobook 640 g4 View
130hpprobook 640 g5 firmware View
131hpprobook 640 g5 View
132hpprobook 640 g7 firmware View
133hpprobook 640 g7 View
134hpprobook 640 g8 firmware View
135hpprobook 640 g8 View
136hpprobook 650 g4 firmware View
137hpprobook 650 g4 View
138hpprobook 650 g5 firmware View
139hpprobook 650 g5 View
140hpprobook 650 g7 firmware View
141hpprobook 650 g7 View
142hpprobook 650 g8 firmware View
143hpprobook 650 g8 View
144hpprobook x360 11 g3 education edition firmware View
145hpprobook x360 11 g3 education edition View
146hpprobook x360 11 g4 education edition firmware View
147hpprobook x360 11 g4 education edition View
148hpprobook x360 11 g5 education edition firmware View
149hpprobook x360 11 g5 education edition View
150hpprobook x360 11 g6 education edition firmware View
151hpprobook x360 11 g6 education edition View
152hpprobook x360 11 g7 education edition firmware View
153hpprobook x360 11 g7 education edition View
154hpprobook x360 440 g1 firmware View
155hpprobook x360 440 g1 View
156hpzbook 14u g5 firmware View
157hpzbook 14u g5 View
158hpzbook 14u g6 firmware View
159hpzbook 14u g6 View
160hpzbook 15 g5 firmware View
161hpzbook 15 g5 View
162hpzbook 15 g6 firmware View
163hpzbook 15 g6 View
164hpzbook 15u g5 firmware View
165hpzbook 15u g5 View
166hpzbook 15u g6 firmware View
167hpzbook 15u g6 View
168hpzbook 17 g5 firmware View
169hpzbook 17 g5 View
170hpzbook 17 g6 firmware View
171hpzbook 17 g6 View
172hpzbook create g7 firmware View
173hpzbook create g7 View
174hpzbook firefly 14 g7 firmware View
175hpzbook firefly 14 g7 View
176hpzbook firefly 14 g8 firmware View
177hpzbook firefly 14 g8 View
178hpzbook firefly 15 g7 firmware View
179hpzbook firefly 15 g7 View
180hpzbook firefly 15 g8 firmware View
181hpzbook firefly 15 g8 View
182hpzbook fury 15 g7 firmware View
183hpzbook fury 15 g7 View
184hpzbook fury 15 g8 firmware View
185hpzbook fury 15 g8 View
186hpzbook fury 17 g7 firmware View
187hpzbook fury 17 g7 View
188hpzbook fury 17 g8 firmware View
189hpzbook fury 17 g8 View
190hpzbook power 15 g8 firmware View
191hpzbook power 15 g8 View
192hpzbook power g7 firmware View
193hpzbook power g7 View
194hpzbook studio 15 g8 firmware View
195hpzbook studio 15 g8 View
196hpzbook studio g5 firmware View
197hpzbook studio g5 View
198hpzbook studio g7 firmware View
199hpzbook studio g7 View
200hpzbook studio x360 g5 firmware View
Total affected vendors: 2|Products: 200

RED HAT CSAF/VEX: Product Impact Check

Red Hat has not yet published a CSAF/VEX impact record for this CVE. This does not mean “not affected”.

SCORING: CVSS from Multiple Sources

CVSS Scores

The Common Vulnerability Scoring System is a standardised framework for assessing the severity of vulnerabilities in software and systems. We collect and display CVSS scores from several sources for each CVE.

SCOREVERSIONSEVERITYVECTORSOURCE
8.8CVSS V31HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HNVD
7.2CVSS V2—AV:L/AC:L/Au:N/C:C/I:C/A:CNVD
6.5CVSS V31MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:HNVD
6.5CVSS V3_1MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:HCVE ADP

Patch and Remediation Guide

Solution & Remediation Advisory

Patch status unknown

İncelenen resmî kaynaklarda yama durumu doğrulanamadı. Bu sonuç “yama yok” anlamına gelmez.

Confirm the affected product and version against the source evidence above.
Restrict access to internet-facing services and apply network segmentation.
Until a patch is confirmed, follow the vendor advisory; do not read an unknown status as “no patch”.
Monitor server logs and network endpoints for signs of anomalous execution.

Public exploit and active exploitation status

Verified exploit intelligence

No verified public PoC, exploit repository or Metasploit module has been found for this CVE yet.

Weakness Classification and Attack Patterns (CWE & CAPEC)

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorises the common flaws or weaknesses that can lead to vulnerabilities. CVE-2021-39298 is associated with the following CWEs:

CWE-269: Common Weakness Enumeration Entry CWE-269

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2021-39298 weaknesses.

CAPEC-66: SQL InjectionCAPEC-126: Path TraversalCAPEC-28: OS Command Injection

Attack Vector and Accessibility

ExposureYerel erişim
PermissionsHigh
UserGerekiyor

Official Sources and Advisories

https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032vendor-advisoryhttps://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1027vendor-advisory

CVSS Vector Radar Chart

6.5 / 10
Attack VectorLocalComplexityLowPrivilegesHighUser Interact.RequiredConfidentialityLowIntegrityHighAvailabilityHigh

Vulnerability Scoring Details

CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Attack VectorLocal
Attack ComplexityLow
Privileges RequiredHigh privileges
User Interaction—
Confidentiality (Gizlilik)Low
Integrity (Bütünlük)High
Availability (Erişilebilirlik)High

Yama durumu bilinmiyor

İncelenen resmî kaynaklarda yama durumu doğrulanamadı. Bu sonuç “yama yok” anlamına gelmez.

Follow the vendor

A
amd logo
amd
H
hp logo
hp

Weakness Type (CWE & CAPEC)

CWE-269

Similar Vulnerabilities

Get this vulnerability through the API

Affected products, version ranges, exploitation status and patch information in a single request, with a free key.

Get a free keyDocumentation
curl -H "x-api-key: $DAYBREACH_API_KEY" \
  "https://api.enginteksut.com.tr/api/v1/intel/cves/CVE-2021-39298"