CVE-2024-21981

{"id": "CVE-2024-21981", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "psirt@amd.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 0.5}]}, "published": "2024-08-13T17:15:22.920", "references": [{"url": "https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3003.html", "source": "psirt@amd.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "Improper key usage control in AMD Secure Processor\n(ASP) may allow an attacker with local access who has gained arbitrary code\nexecution privilege in ASP\u00a0to\nextract ASP cryptographic keys, potentially resulting in loss of\nconfidentiality and integrity."}, {"lang": "es", "value": "Un control inadecuado del uso de claves en el procesador seguro AMD (ASP) puede permitir que un atacante con acceso local que haya obtenido privilegios de ejecuci\u00f3n de c\u00f3digo arbitrario en ASP extraiga claves criptogr\u00e1ficas ASP, lo que podr\u00eda provocar una p\u00e9rdida de confidencialidad e integridad."}], "lastModified": "2024-08-15T18:35:06.310", "sourceIdentifier": "psirt@amd.com"}