CVE-2021-26386

Q: What is the severity of CVE-2021-26386?

CVE-2021-26386 has a CVSS score of 7.8 (HIGH). CVE-2021-26386 is a memory corruption vulnerability in AMD's Stage 2 Bootloader that could allow a malicious or compromised UApp or ABL to execute arbitrary code. This affects AMD processors with vulnerable firmware versions. Attackers could potentially gain elevated privileges or compromise system integrity.

7.8 HIGH

📋 TL;DR

CVE-2021-26386 is a memory corruption vulnerability in AMD's Stage 2 Bootloader that could allow a malicious or compromised UApp or ABL to execute arbitrary code. This affects AMD processors with vulnerable firmware versions. Attackers could potentially gain elevated privileges or compromise system integrity.

💻 Affected Systems

Products:

AMD EPYC Processors
AMD Ryzen Processors with AMD Secure Processor

Versions: Specific firmware versions as listed in AMD advisory AMD-SB-1027

Operating Systems: All operating systems running on affected AMD processors

Default Config Vulnerable: ⚠️ Yes

Notes: Vulnerability exists in the AMD Secure Processor firmware, affecting systems regardless of operating system.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete system compromise with attacker gaining full control over the affected system, potentially establishing persistence and moving laterally.

🟠

Likely Case

Local privilege escalation allowing attackers to bypass security controls and execute code with higher privileges.

🟢

If Mitigated

Limited impact with proper firmware updates and security controls preventing unauthorized access to bootloader components.

🌐 Internet-Facing: LOW - This is a local vulnerability requiring access to the system's boot process.

🏢 Internal Only: HIGH - Malicious insiders or compromised internal systems could exploit this for privilege escalation.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: HIGH

Exploitation requires access to the AMD Secure Processor environment and knowledge of the malformed system call structure.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Firmware updates as specified in AMD advisory AMD-SB-1027

Vendor Advisory: https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1027

Restart Required: Yes

Instructions:

1. Check AMD advisory AMD-SB-1027 for affected processor models. 2. Contact system manufacturer for BIOS/UEFI firmware updates. 3. Apply firmware updates following manufacturer instructions. 4. Reboot system to activate new firmware.

🔧 Temporary Workarounds

Restrict Physical Access

all

Limit physical access to systems to prevent local exploitation attempts.

Secure Boot Configuration

all

Ensure Secure Boot is enabled and properly configured to limit unauthorized bootloader modifications.

🧯 If You Can't Patch

Implement strict access controls to prevent unauthorized local access to systems.
Monitor for unusual bootloader activity and privilege escalation attempts.

🔍 How to Verify

Check if Vulnerable:

Check system BIOS/UEFI firmware version against AMD advisory AMD-SB-1027 for affected versions.

Check Version:

On Linux: 'sudo dmidecode -t bios' or 'sudo cat /sys/class/dmi/id/bios_version'. On Windows: 'wmic bios get smbiosbiosversion'

Verify Fix Applied:

Verify firmware version has been updated to a version not listed in the AMD advisory.

📡 Detection & Monitoring

Log Indicators:

Unexpected system reboots
Bootloader modification attempts
AMD Secure Processor error logs

Network Indicators:

None - this is a local vulnerability

SIEM Query:

Search for: 'Event ID 6008' (Unexpected shutdown) OR 'Secure Boot violation' OR 'Firmware update' events in system logs

📊 Metadata

CVE ID: CVE-2021-26386

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-787

Published: May 12, 2022

Last Updated: November 21, 2024

🔗 References

https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1027 Vendor Advisory
https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1027 Vendor Advisory

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Ryzen 3 2200u Firmware by Amd

Ryzen 3 2300u Firmware by Amd

Ryzen 3 3100 Firmware by Amd

Ryzen 3 3300g Firmware by Amd

Ryzen 3 3300x Firmware by Amd

Ryzen 3 5125c Firmware by Amd

Ryzen 3 5400u Firmware by Amd

Ryzen 3 5425c Firmware by Amd

Ryzen 3 5425u Firmware by Amd

Ryzen 5 2500u Firmware by Amd

Ryzen 5 2600 Firmware by Amd

Ryzen 5 2600h Firmware by Amd

Ryzen 5 2600x Firmware by Amd

Ryzen 5 3400g Firmware by Amd

Ryzen 5 3450g Firmware by Amd

Ryzen 5 3600 Firmware by Amd

Ryzen 5 3600x Firmware by Amd

Ryzen 5 5560u Firmware by Amd

Ryzen 5 5600h Firmware by Amd

Ryzen 5 5600hs Firmware by Amd

Ryzen 5 5600u Firmware by Amd

Ryzen 5 5600x Firmware by Amd

Ryzen 5 5625c Firmware by Amd

Ryzen 5 5625u Firmware by Amd

Ryzen 5 5700g Firmware by Amd

Ryzen 5 5700ge Firmware by Amd

Ryzen 5300g Firmware by Amd

Ryzen 5300ge Firmware by Amd

Ryzen 5600g Firmware by Amd

Ryzen 5600ge Firmware by Amd

Ryzen 5600x Firmware by Amd

Ryzen 5700g Firmware by Amd

Ryzen 5700ge Firmware by Amd

Ryzen 5800x Firmware by Amd

Ryzen 5800x3d Firmware by Amd

Ryzen 5900x Firmware by Amd

Ryzen 5950x Firmware by Amd

Ryzen 7 2700 Firmware by Amd

Ryzen 7 2700u Firmware by Amd

Ryzen 7 2700x Firmware by Amd

Ryzen 7 2800h Firmware by Amd

Ryzen 7 3700x Firmware by Amd

Ryzen 7 3800x Firmware by Amd

Ryzen 7 5800h Firmware by Amd

Ryzen 7 5800hs Firmware by Amd

Ryzen 7 5800u Firmware by Amd

Ryzen 7 5825c Firmware by Amd

Ryzen 7 5825u Firmware by Amd

Ryzen 9 3900x Firmware by Amd

Ryzen 9 3950x Firmware by Amd

Ryzen 9 5900hs Firmware by Amd

Ryzen 9 5900hx Firmware by Amd

Ryzen 9 5980hs Firmware by Amd

Ryzen 9 5980hx Firmware by Amd

Ryzen Threadripper 2920x Firmware by Amd

Ryzen Threadripper 2950x Firmware by Amd

Ryzen Threadripper 2970wx Firmware by Amd

Ryzen Threadripper 2990wx Firmware by Amd

Ryzen Threadripper 3960x Firmware by Amd

Ryzen Threadripper 3970x Firmware by Amd

Ryzen Threadripper 3990x Firmware by Amd

Ryzen Threadripper Pro 3945wx Firmware by Amd

Ryzen Threadripper Pro 3955wx Firmware by Amd

Ryzen Threadripper Pro 3975wx Firmware by Amd

Ryzen Threadripper Pro 3995wx Firmware by Amd

Ryzen Threadripper Pro 5945wx Firmware by Amd

Ryzen Threadripper Pro 5955wx Firmware by Amd

Ryzen Threadripper Pro 5965wx Firmware by Amd

Ryzen Threadripper Pro 5975wx Firmware by Amd

Ryzen Threadripper Pro 5995wx Firmware by Amd