Description
An observable timing discrepancy in the ASP could allow a privileged attacker to perform a brute-force attack against the hash message authentication code, allowing arbitrary message input, potentially leading to a loss of data integrity.
CVSS breakdown
CVSS 4.0
Attack Vector
Local
Attack Complexity
High
Attack Requirements
None
Privileges Required
High
User Interaction
None
Confidentiality (Vulnerable System)
None
Integrity (Vulnerable System)
Low
Availability (Vulnerable System)
None
Confidentiality (Subsequent System)
None
Integrity (Subsequent System)
None
Availability (Subsequent System)
None
Affected products
- AMD / AMD Ryzen™ 3000 Series Desktop ProcessorsComboAM4 1.0.0.E – ComboAM4 1.0.0.E
- AMD / AMD Ryzen™ 3000 Series Desktop ProcessorsComboAM4v2PI 1.2.0.CA – ComboAM4v2PI 1.2.0.CA
- AMD / AMD Ryzen™ 5000 Series Desktop ProcessorsComboAM4v2PI 1.2.0.CA – ComboAM4v2PI 1.2.0.CA
- AMD / AMD Ryzen™ Threadripper™ 3000 Series ProcessorsCastlePeakPI-SP3r3 1.0.0.C – CastlePeakPI-SP3r3 1.0.0.C
- AMD / AMD Ryzen™ Threadripper™ PRO 3000WX Series ProcessorsCastlePeakWSPI-sWRX8 1.0.0.E – CastlePeakWSPI-sWRX8 1.0.0.E
- AMD / AMD Ryzen™ Threadripper™ PRO 5000 WX-Series ProcessorsChagallWSPI-sWRX8 1.0.0.9 – ChagallWSPI-sWRX8 1.0.0.9