x86-64.net

Firmware area

AMD AGESA, SMM and BIOS firmware

The CVEs of AMD's AGESA firmware on the x86 side: SMM handlers and UEFI modules, the SPI flash protections, and the SMM lock.

Also known as
AGESA, System Management Mode
Kind
Firmware
CVEs
42
Published
2021–2026

AGESA is the firmware AMD gives board makers to start its processors. Part of it runs on the x86 cores as UEFI modules, and some of those install handlers for System Management Mode (SMM), the mode that firmware keeps for itself and that the operating system cannot see into. Most CVEs here are SMI handlers that trust a pointer or buffer the operating system controls, call code outside SMRAM, or let ring 0 code reach the SPI flash that holds the firmware; one, CVE-2023-31315, is a processor register that the SMM lock did not cover.

Fixes come as AGESA or PI versions in BIOS updates from the board maker, and for a few CVEs as microcode. The monthly bulletins below also hold CVEs of the AMD Secure Processor and of SEV, which are on their own pages; AMD-SB-7043 has no CVE: AMD holds that an EDK2 bug in SMI entry, reached through an injected machine check, does not affect its current processors.

CVEs

CVENameVendorsPublished
CVE-2020-12890SMM callout in AGESAAMD2021-12-10
CVE-2020-12954Chipset option bypasses SPI ROM protection (described below)AMD2021-11-16
CVE-2021-26316BIOS communication buffer (described below)AMD2023-01-10
CVE-2021-26317SMM protocol not verified (described below)AMD2022-05-12
CVE-2021-26384SMI trigger data (described below)AMD2022-07-14
CVE-2021-26388BIOS directory search (described below)AMD2022-05-11
CVE-2021-39298SMM interrupt handler (described below)AMD2022-02-16
CVE-2022-23820SMM communication buffer (described below)AMD2023-11-14
CVE-2022-23821SPI ROM writes through SMM (described below)AMD2023-11-14
CVE-2022-23829SPI lock bypassAMD2024-06-18
CVE-2023-20555CpmDisplayFeatureSmm bit overwriteAMD2023-08-08
CVE-2023-20558AmdCpmOemSmm control flow (described below)AMD2023-03-23
CVE-2023-20559AmdCpmGpioInitSmm control flow (described below)AMD2023-03-23
CVE-2023-20563SMM code protections (described below)AMD2023-11-14
CVE-2023-20565SMM code protections (second CVE) (described below)AMD2023-11-14
CVE-2023-20571SMM race with CVE-2018-8897 (described below)AMD2023-11-14
CVE-2023-20576AGESA data authenticity (described below)AMD2026-09-02
CVE-2023-20577SMM module heap overflow (described below)AMD2026-09-02
CVE-2023-20578SMM communication buffer race (described below)AMD2024-08-13
CVE-2023-20579SPI protection bypass from ring 0 (described below)AMD2024-02-13
CVE-2023-20587SPI flash through SMM (described below)AMD2024-02-13
CVE-2023-20594DXE driver variables (1) (described below)AMD2023-09-20
CVE-2023-20596SMM Supervisor initializationAMD2023-11-14
CVE-2023-20597DXE driver variables (2) (described below)AMD2023-09-20
CVE-2023-31315SMM lock bypass (Sinkclose)AMD2024-08-09
CVE-2023-31342SMM handler overwrites SMRAM (1) (described below)AMD2025-02-11
CVE-2023-31343SMM handler overwrites SMRAM (2) (described below)AMD2025-02-11
CVE-2023-31345SMM handler overwrites SMRAM (3) (described below)AMD2025-02-11
CVE-2024-0179SMM callout in AmdCpmDisplayFeatureSMMAMD2025-02-11
CVE-2024-21924SMM callout in AmdPlatformRasSspSmmAMD2025-02-11
CVE-2024-21925AmdPspP2CmboxV2 input validationAMD2025-02-11
CVE-2024-21947SMM arbitrary memory write (described below)AMD2025-09-06
CVE-2024-36310SMM communication buffer bounds (described below)AMD2026-02-10
CVE-2024-36311SMM communication buffer race (described below)AMD2026-02-10
CVE-2024-36326RomArmor on resume (described below)AMD2025-09-06
CVE-2024-36343SMM buffer and TSEG (described below)AMD2026-05-19
CVE-2024-36345AMD OverDrive SMM module (described below)AMD2026-05-15
CVE-2024-36354DIMM SPD data and SMM (described below)AMD2025-09-06
CVE-2024-36355SMM handler and S3 resume (described below)AMD2026-02-10
CVE-2025-29950SMM stack overwrite (described below)AMD2026-02-10
CVE-2025-54502LocateProtocol in the APCB SMM driverAMD2026-04-16
CVE-2026-0438SMM callout (described below)AMD2026-05-15

CVEs without a page of their own

The sources give these CVEs too few facts of their own (affected processors, a mitigation, a check) for a page; this is what they say.

CVE-2020-12954: Chipset option bypasses SPI ROM protection

A side effect of an integrated chipset option could be used to get around SPI ROM protections and change the ROM. AMD-SB-1021. Source. CVE record (2021-11-16).

CVE-2021-26316: BIOS communication buffer

The BIOS did not validate its communication buffer and service, so an attacker could tamper with the buffer and run code in SMM. AMD-SB-1031. Source. CVE record (2023-01-10).

CVE-2021-26317: SMM protocol not verified

SMM code did not verify a protocol, so an attacker could control it and change SPI flash. AMD-SB-1027. Source. CVE record (2022-05-12).

CVE-2021-26384: SMI trigger data

A malformed SMI command could set up a corrupted SMI trigger structure that later caused out-of-bounds reads and writes. AMD-SB-1027. Source. CVE record (2022-07-14).

CVE-2021-26388: BIOS directory search

The BIOS directory was not validated, so searches could read past the copy of the directory table in RAM. AMD-SB-1027. Source. CVE record (2022-05-11).

CVE-2021-39298: SMM interrupt handler

A flaw in an AMD SMI handler let a highly privileged attacker run code in SMM and bypass UEFI protections. AMD-SB-1027. Source. CVE record (2022-02-16).

CVE-2022-23820: SMM communication buffer

The AMD SMM communication buffer was not validated, so an attacker could corrupt SMRAM and run code. AMD-SB-3002. Source. CVE record (2023-11-14).

CVE-2022-23821: SPI ROM writes through SMM

Weak access control in SMM let an attacker write the SPI ROM and run code. AMD-SB-4002. Source. CVE record (2023-11-14).

CVE-2023-20558: AmdCpmOemSmm control flow

Weak control flow handling in the AmdCpmOemSmm module let a privileged attacker tamper with the SMI handler. AMD-SB-1027. Source. CVE record (2023-03-23).

CVE-2023-20559: AmdCpmGpioInitSmm control flow

Weak control flow handling in the AmdCpmGpioInitSmm module let a privileged attacker tamper with the SMI handler. AMD-SB-1027. Source. CVE record (2023-03-23).

CVE-2023-20563: SMM code protections

Missing protections in SMM code could let a local attacker raise privileges. AMD-SB-4002. Source. CVE record (2023-11-14).

CVE-2023-20565: SMM code protections (second CVE)

AMD gave a second CVE, with the same description, to missing protections in SMM code that allow privilege escalation. AMD-SB-4002. Source. CVE record (2023-11-14).

CVE-2023-20571: SMM race with CVE-2018-8897

A race in SMM code let an attacker in user space use the POP SS debug exception issue CVE-2018-8897 to raise privileges. AMD-SB-4002. Source. CVE record (2023-11-14).

CVE-2023-20576: AGESA data authenticity

AGESA did not verify the authenticity of data, so an attacker could change SPI ROM data. AMD-SB-7009. Source. CVE record (2026-09-02).

CVE-2023-20577: SMM module heap overflow

A heap overflow in an SMM module could run code for an attacker who can also write SPI flash through another flaw. AMD-SB-7009. Source. CVE record (2026-09-02).

CVE-2023-20578: SMM communication buffer race

A race in SMM let an attacker with ring 0 and BIOS setup access change the communication buffer after it was checked. AMD-SB-3003. Source. CVE record (2024-08-13).

CVE-2023-20579: SPI protection bypass from ring 0

Weak access control in AMD's SPI protection let ring 0 code get around it. AMD-SB-7009. Source. CVE record (2024-02-13).

CVE-2023-20587: SPI flash through SMM

Weak access control in SMM gave an attacker access to SPI flash; AMD later marked server and embedded processors not affected. AMD-SB-7009. Source. CVE record (2024-02-13).

CVE-2023-20594: DXE driver variables (1)

A DXE driver did not initialize variables, so a privileged user could read leftover data. AMD-SB-4007. Source. CVE record (2023-09-20).

CVE-2023-20597: DXE driver variables (2)

A second DXE driver flaw of the same kind, on a different set of processors, let a privileged user read leftover data. AMD-SB-4007. Source. CVE record (2023-09-20).

CVE-2023-31342: SMM handler overwrites SMRAM (1)

Missing input checks in an SMI handler let a privileged attacker overwrite SMRAM and run code. AMD-SB-3009. Source. CVE record (2025-02-11).

CVE-2023-31343: SMM handler overwrites SMRAM (2)

Another SMI handler with missing input checks let a privileged attacker overwrite SMRAM. AMD-SB-3009. Source. CVE record (2025-02-11).

CVE-2023-31345: SMM handler overwrites SMRAM (3)

A third SMI handler with missing input checks let a privileged attacker overwrite SMRAM. AMD-SB-3009. Source. CVE record (2025-02-11).

CVE-2024-21947: SMM arbitrary memory write

Missing input checks in SMM let a privileged attacker overwrite arbitrary memory and run code at the SMM level. AMD-SB-4012. Source. CVE record (2025-09-06).

CVE-2024-36310: SMM communication buffer bounds

Missing checks on the SMM communication buffer allowed reads and writes outside it into SMRAM. AMD-SB-3023. Source. CVE record (2026-02-10).

CVE-2024-36311: SMM communication buffer race

A race on the SMM communication buffer let a privileged attacker get past its checks and access memory out of bounds. AMD-SB-3023. Source. CVE record (2026-02-10).

CVE-2024-36326: RomArmor on resume

RomArmor did not check authorization when resuming from standby, so its protection could be bypassed. AMD-SB-4012. Source. CVE record (2025-09-06).

CVE-2024-36343: SMM buffer and TSEG

Missing checks on the SMM communication buffer allowed reads and writes into part of the TSEG region. AMD-SB-3030. Source. CVE record (2026-05-19).

CVE-2024-36345: AMD OverDrive SMM module

Missing input checks in the AMD OverDrive SMM module allowed an out-of-bounds read. AMD-SB-3030. Source. CVE record (2026-05-15).

CVE-2024-36354: DIMM SPD data and SMM

Unvalidated DIMM SPD data could let an attacker get around SMM isolation and run code in SMM. AMD-SB-3014. Source. CVE record (2025-09-06).

CVE-2024-36355: SMM handler and S3 resume

Missing checks in an SMI handler let ring 0 code write SMRAM and change what runs on S3 resume. AMD-SB-3023. Source. CVE record (2026-02-10).

CVE-2025-29950: SMM stack overwrite

Missing input checks in SMM let a privileged attacker overwrite stack memory and run code. AMD-SB-3023. Source. CVE record (2026-02-10).

CVE-2026-0438: SMM callout

An SMI handler could call code outside SMRAM, which a highly privileged attacker could replace with their own. AMD-SB-3030. Source. CVE record (2026-05-15).

Advisories

AMD-SB-4017: AMD Athlon, AMD Ryzen, and AMD Ryzen Embedded Series Processor Vulnerabilities - May 2026

2026-05-12. CVE-2021-26380, CVE-2021-46747, CVE-2022-23826, CVE-2023-31316, CVE-2024-36315, CVE-2024-36343, CVE-2024-36345, CVE-2025-0040, CVE-2025-48516, CVE-2026-0438

AMD-SB-3030: AMD EPYC and AMD EPYC Embedded Series Processor Vulnerabilities - May 2026

2026-05-12. CVE-2024-36315, CVE-2024-36343, CVE-2024-36345, CVE-2025-61971, CVE-2025-61972, CVE-2026-0438

AMD-SB-7054: Incorrect use of LocateProtocol Service of the EFI_BOOT_Services table in SMI Handler

2026-04-14. CVE-2025-54502

AMD-SB-4013: AMD Athlon and AMD Ryzen Processor Vulnerabilities - February 2026

2026-02-10. CVE-2021-26381, CVE-2021-26410, CVE-2023-20540, CVE-2024-21953, CVE-2024-21961, CVE-2024-36310, CVE-2024-36311, CVE-2024-36355, CVE-2025-0012, CVE-2025-0029, CVE-2025-0031, CVE-2025-29939, CVE-2025-29946, CVE-2025-29948, CVE-2025-29949, CVE-2025-29950, CVE-2025-29951, CVE-2025-29952, CVE-2025-48509, CVE-2025-48514, CVE-2025-48515, CVE-2025-48517, CVE-2025-52533, CVE-2025-52534, CVE-2025-52536, CVE-2025-54514

AMD-SB-3023: AMD EPYC and AMD EPYC Embedded Series Processor Vulnerabilities - February 2026

2026-02-10. CVE-2024-21953, CVE-2024-21961, CVE-2024-36310, CVE-2024-36311, CVE-2024-36355, CVE-2025-0012, CVE-2025-0029, CVE-2025-0031, CVE-2025-29939, CVE-2025-29946, CVE-2025-29948, CVE-2025-29950, CVE-2025-29952, CVE-2025-48509, CVE-2025-48514, CVE-2025-48517, CVE-2025-52533, CVE-2025-52534, CVE-2025-52536, CVE-2025-54514

AMD-SB-5007: AMD Embedded Vulnerabilities - August 2025

2025-08-12. CVE-2021-26377, CVE-2021-26383, CVE-2021-26410, CVE-2021-46750, CVE-2021-46757, CVE-2023-20540, CVE-2023-20572, CVE-2023-31326, CVE-2023-31351, CVE-2024-21947, CVE-2024-21970, CVE-2024-21977, CVE-2024-36331, CVE-2024-36354, CVE-2025-0032

AMD-SB-4012: AMD Client Vulnerabilities - August 2025

2025-08-12. CVE-2021-26377, CVE-2021-26383, CVE-2021-46750, CVE-2021-46757, CVE-2023-20540, CVE-2023-20572, CVE-2023-31325, CVE-2023-31326, CVE-2023-31330, CVE-2024-21947, CVE-2024-21970, CVE-2024-21977, CVE-2024-36326, CVE-2024-36354, CVE-2025-0032

AMD-SB-3014: AMD Server Vulnerabilities - August 2025

2025-08-12. CVE-2023-31351, CVE-2024-21977, CVE-2024-36331, CVE-2024-36354, CVE-2025-0032

AMD-SB-7043: EDK2 SMM MCE Enablement Issue

2025-08-06.

AMD-SB-7028: AMD SMM Callout Vulnerability

2025-02-11. CVE-2024-21924

AMD-SB-7027: AMD SMM Vulnerabilities

2025-02-11. CVE-2024-0179, CVE-2024-21925

AMD-SB-5004: AMD Embedded Processors Vulnerabilities - February 2025

2025-02-11. CVE-2023-20507, CVE-2023-20515, CVE-2023-20581, CVE-2023-20582, CVE-2023-31331, CVE-2023-31342, CVE-2023-31343, CVE-2023-31345, CVE-2023-31352, CVE-2023-31356

AMD-SB-4008: AMD Client Processor Vulnerabilities - February 2025

2025-02-11. CVE-2023-20507, CVE-2023-20515, CVE-2023-31331, CVE-2023-31342, CVE-2023-31343, CVE-2023-31345

AMD-SB-3009: AMD Server Processor Vulnerabilities - February 2025

2025-02-11. CVE-2023-20581, CVE-2023-20582, CVE-2023-31342, CVE-2023-31343, CVE-2023-31345, CVE-2023-31352

AMD-SB-5002: AMD Embedded Processors Vulnerabilities - Aug 2024

2024-08-13. CVE-2021-26344, CVE-2021-26367, CVE-2021-26387, CVE-2021-46746, CVE-2021-46772, CVE-2022-23815, CVE-2022-23817, CVE-2023-20518, CVE-2023-20578, CVE-2023-20591, CVE-2024-21981

AMD-SB-4004: Client Vulnerabilities - Aug 2024

2024-08-13. CVE-2021-26344, CVE-2021-26367, CVE-2021-26387, CVE-2021-46746, CVE-2021-46772, CVE-2022-23815, CVE-2022-23817, CVE-2023-20518, CVE-2023-20578, CVE-2024-21981

AMD-SB-3003: AMD Server Vulnerabilities - August 2024

2024-08-13. CVE-2021-26344, CVE-2021-26387, CVE-2021-46746, CVE-2021-46772, CVE-2023-20518, CVE-2023-20578, CVE-2023-20584, CVE-2023-20591, CVE-2023-31356, CVE-2024-21981

AMD-SB-7014: SMM Lock Bypass

2024-08-09. CVE-2023-31315

AMD-SB-1041: SPI Lock Bypass

2024-06-11. CVE-2022-23829

AMD-SB-7009: AMD Processor Vulnerabilities

2024-02-13. CVE-2023-20576, CVE-2023-20577, CVE-2023-20579, CVE-2023-20587

AMD-SB-5001: AMD Embedded Processors Vulnerabilities - February 2024

2024-02-13. CVE-2020-12930, CVE-2020-12931, CVE-2021-26345, CVE-2021-26392, CVE-2021-26393, CVE-2021-46754, CVE-2021-46757, CVE-2021-46762, CVE-2021-46766, CVE-2021-46774, CVE-2022-23820, CVE-2022-23821, CVE-2022-23830, CVE-2023-20521, CVE-2023-20526, CVE-2023-20533, CVE-2023-20563, CVE-2023-20565, CVE-2023-20566, CVE-2023-20571

AMD-SB-7011: AMD SMM Supervisor Vulnerability Security Notice

2023-11-14. CVE-2023-20596

AMD-SB-4002: AMD Client Vulnerabilities - November 2023

2023-11-14. CVE-2021-46758, CVE-2021-46766, CVE-2021-46774, CVE-2022-23820, CVE-2022-23821, CVE-2023-20521, CVE-2023-20526, CVE-2023-20533, CVE-2023-20563, CVE-2023-20565, CVE-2023-20571

AMD-SB-3002: AMD Server Vulnerabilities - Nov 2023

2023-11-14. CVE-2021-26345, CVE-2021-46766, CVE-2021-46774, CVE-2022-23820, CVE-2022-23830, CVE-2023-20519, CVE-2023-20521, CVE-2023-20526, CVE-2023-20533, CVE-2023-20566

AMD-SB-4007: DXE Driver Memory Leaks

2023-09-20. CVE-2023-20594, CVE-2023-20597

AMD-SB-4003: SMM Memory Corruption Vulnerability

2023-08-08. CVE-2023-20555

AMD-SB-1032: AMD Server Vulnerabilities - January 2023

2023-01-10. CVE-2021-26316, CVE-2021-26328, CVE-2021-26343, CVE-2021-26353, CVE-2021-26355, CVE-2021-26396, CVE-2021-26398, CVE-2021-26402, CVE-2021-26403, CVE-2021-26404, CVE-2021-26407, CVE-2021-26409, CVE-2021-39298, CVE-2021-46767, CVE-2021-46768, CVE-2021-46779, CVE-2021-46791, CVE-2022-23813, CVE-2022-23814, CVE-2023-20522, CVE-2023-20523, CVE-2023-20525, CVE-2023-20527, CVE-2023-20528, CVE-2023-20529, CVE-2023-20530, CVE-2023-20531, CVE-2023-20532

AMD-SB-1031: AMD Client Vulnerabilities - January 2023

2023-01-10. CVE-2021-26316, CVE-2021-26346, CVE-2021-46795

AMD-SB-1028: AMD Server Vulnerabilities - May 2022

2022-05-10. CVE-2021-26312, CVE-2021-26339, CVE-2021-26342, CVE-2021-26347, CVE-2021-26348, CVE-2021-26349, CVE-2021-26350, CVE-2021-26364, CVE-2021-26372, CVE-2021-26373, CVE-2021-26375, CVE-2021-26376, CVE-2021-26378, CVE-2021-26388

AMD-SB-1027: AMD Client Vulnerabilities - May 2022

2022-05-10. CVE-2020-12944, CVE-2020-12946, CVE-2020-12951, CVE-2021-26312, CVE-2021-26317, CVE-2021-26335, CVE-2021-26336, CVE-2021-26337, CVE-2021-26339, CVE-2021-26347, CVE-2021-26348, CVE-2021-26349, CVE-2021-26350, CVE-2021-26351, CVE-2021-26352, CVE-2021-26353, CVE-2021-26361, CVE-2021-26362, CVE-2021-26363, CVE-2021-26366, CVE-2021-26368, CVE-2021-26369, CVE-2021-26370, CVE-2021-26372, CVE-2021-26373, CVE-2021-26375, CVE-2021-26376, CVE-2021-26378, CVE-2021-26382, CVE-2021-26384, CVE-2021-26386, CVE-2021-26388, CVE-2021-26390, CVE-2021-39298, CVE-2021-46771, CVE-2023-20558, CVE-2023-20559

AMD-SB-1021: AMD Server Vulnerabilities - November 2021

2021-11-08. CVE-2020-12944, CVE-2020-12946, CVE-2020-12951, CVE-2020-12954, CVE-2020-12961, CVE-2020-12988, CVE-2021-26312, CVE-2021-26315, CVE-2021-26320, CVE-2021-26321, CVE-2021-26322, CVE-2021-26323, CVE-2021-26324, CVE-2021-26325, CVE-2021-26326, CVE-2021-26327, CVE-2021-26329, CVE-2021-26330, CVE-2021-26331, CVE-2021-26332, CVE-2021-26335, CVE-2021-26336, CVE-2021-26337, CVE-2021-26338, CVE-2021-26351, CVE-2021-26352, CVE-2021-26353, CVE-2021-26370, CVE-2021-26390, CVE-2021-26408, CVE-2021-46771

Sources

  1. AMD Product Security: bulletins archive, 2020
  2. AMD-SB-4017: AMD Athlon, AMD Ryzen, and AMD Ryzen Embedded Series Processor Vulnerabilities - May 2026
  3. AMD-SB-3030: AMD EPYC and AMD EPYC Embedded Series Processor Vulnerabilities - May 2026
  4. AMD-SB-7054: Incorrect use of LocateProtocol Service of the EFI_BOOT_Services table in SMI Handler
  5. AMD-SB-4013: AMD Athlon and AMD Ryzen Processor Vulnerabilities - February 2026
  6. AMD-SB-3023: AMD EPYC and AMD EPYC Embedded Series Processor Vulnerabilities - February 2026
  7. AMD-SB-5007: AMD Embedded Vulnerabilities - August 2025
  8. AMD-SB-4012: AMD Client Vulnerabilities - August 2025
  9. AMD-SB-3014: AMD Server Vulnerabilities - August 2025
  10. AMD-SB-7043: EDK2 SMM MCE Enablement Issue
  11. AMD-SB-7028: AMD SMM Callout Vulnerability
  12. AMD-SB-7027: AMD SMM Vulnerabilities
  13. AMD-SB-5004: AMD Embedded Processors Vulnerabilities - February 2025
  14. AMD-SB-4008: AMD Client Processor Vulnerabilities - February 2025
  15. AMD-SB-3009: AMD Server Processor Vulnerabilities - February 2025
  16. AMD-SB-5002: AMD Embedded Processors Vulnerabilities - Aug 2024
  17. AMD-SB-4004: Client Vulnerabilities - Aug 2024
  18. AMD-SB-3003: AMD Server Vulnerabilities - August 2024
  19. AMD-SB-7014: SMM Lock Bypass
  20. AMD-SB-1041: SPI Lock Bypass
  21. AMD-SB-7009: AMD Processor Vulnerabilities
  22. AMD-SB-5001: AMD Embedded Processors Vulnerabilities - February 2024
  23. AMD-SB-7011: AMD SMM Supervisor Vulnerability Security Notice
  24. AMD-SB-4002: AMD Client Vulnerabilities - November 2023
  25. AMD-SB-3002: AMD Server Vulnerabilities - Nov 2023
  26. AMD-SB-4007: DXE Driver Memory Leaks
  27. AMD-SB-4003: SMM Memory Corruption Vulnerability
  28. AMD-SB-1032: AMD Server Vulnerabilities - January 2023
  29. AMD-SB-1031: AMD Client Vulnerabilities - January 2023
  30. AMD-SB-1028: AMD Server Vulnerabilities - May 2022
  31. AMD-SB-1027: AMD Client Vulnerabilities - May 2022
  32. AMD-SB-1021: AMD Server Vulnerabilities - November 2021