Insufficient DRAM address validation in System Management Unit (SMU) may allow an attacker to read/write from/to an invalid DRAM address, potentially resulting in denial-of-service.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4654-1 advisory.

  - Failure to validate the value in APCB may allow a privileged attacker to tamper with the APCB token to     force an out-of-bounds memory read potentially resulting in a denial of service. (CVE-2021-26345)

  - Improper clearing of sensitive data in the ASP Bootloader may expose secret keys to a privileged attacker     accessing ASP SRAM, potentially leading to a loss of confidentiality. (CVE-2021-46766)

  - Insufficient DRAM address validation in System Management Unit (SMU) may allow an attacker to read/write     from/to an invalid DRAM address, potentially resulting in denial-of-service. (CVE-2021-46774,     CVE-2023-20533)

  - Failure to validate the AMD SMM communication buffer may allow an attacker to corrupt the SMRAM     potentially leading to arbitrary code execution. (CVE-2022-23820)

  - SMM configuration may not be immutable, as intended, when SNP is enabled resulting in a potential limited     loss of guest memory integrity. (CVE-2022-23830)

  - A Use-After-Free vulnerability in the management of an SNP guest context page may allow a malicious     hypervisor to masquerade as the guest's migration agent resulting in a potential loss of guest integrity.
    (CVE-2023-20519)

  - TOCTOU in the ASP Bootloader may allow an attacker with physical access to tamper with SPI ROM records     after memory content verification, potentially leading to loss of confidentiality or a denial of service.
    (CVE-2023-20521)

  - Insufficient input validation in the ASP Bootloader may enable a privileged attacker with physical access     to expose the contents of ASP memory potentially leading to a loss of confidentiality. (CVE-2023-20526)

  - Improper address validation in ASP with SNP enabled may potentially allow an attacker to compromise guest     memory integrity. (CVE-2023-20566)

  - Improper or unexpected behavior of the INVD instruction in some AMD CPUs may allow an attacker with a     malicious hypervisor to affect cache line write-back behavior of the CPU leading to a potential loss of     guest virtual machine (VM) memory integrity. (CVE-2023-20592)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4665-1 advisory.

  - Failure to validate the value in APCB may allow a privileged attacker to tamper with the APCB token to     force an out-of-bounds memory read potentially resulting in a denial of service. (CVE-2021-26345)

  - Improper clearing of sensitive data in the ASP Bootloader may expose secret keys to a privileged attacker     accessing ASP SRAM, potentially leading to a loss of confidentiality. (CVE-2021-46766)

  - Insufficient DRAM address validation in System Management Unit (SMU) may allow an attacker to read/write     from/to an invalid DRAM address, potentially resulting in denial-of-service. (CVE-2021-46774,     CVE-2023-20533)

  - Failure to validate the AMD SMM communication buffer may allow an attacker to corrupt the SMRAM     potentially leading to arbitrary code execution. (CVE-2022-23820)

  - SMM configuration may not be immutable, as intended, when SNP is enabled resulting in a potential limited     loss of guest memory integrity. (CVE-2022-23830)

  - A Use-After-Free vulnerability in the management of an SNP guest context page may allow a malicious     hypervisor to masquerade as the guest's migration agent resulting in a potential loss of guest integrity.
    (CVE-2023-20519)

  - TOCTOU in the ASP Bootloader may allow an attacker with physical access to tamper with SPI ROM records     after memory content verification, potentially leading to loss of confidentiality or a denial of service.
    (CVE-2023-20521)

  - Insufficient input validation in the ASP Bootloader may enable a privileged attacker with physical access     to expose the contents of ASP memory potentially leading to a loss of confidentiality. (CVE-2023-20526)

  - Improper address validation in ASP with SNP enabled may potentially allow an attacker to compromise guest     memory integrity. (CVE-2023-20566)

  - Improper or unexpected behavior of the INVD instruction in some AMD CPUs may allow an attacker with a     malicious hypervisor to affect cache line write-back behavior of the CPU leading to a potential loss of     guest virtual machine (VM) memory integrity. (CVE-2023-20592)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
186648	SUSE SLES15 Security Update : kernel-firmware (SUSE-SU-2023:4654-1)	Nessus	SuSE Local Security Checks	critical
186646	SUSE SLES15 Security Update : kernel-firmware (SUSE-SU-2023:4665-1)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2021-46774

high

Tenable Plugins

critical

critical