CVE-2021-26345: 
Linux openSUSE vulnerability analysis and mitigation

CVE-2021-26345 is a security vulnerability discovered in AMD EPYC processors' firmware. The vulnerability was first recorded on January 29, 2021, and involves a failure to validate values in APCB (AMD Platform Configuration Block) (NVD).

The vulnerability is characterized by an out-of-bounds memory read condition (CWE-125) that occurs due to improper validation of APCB values. It has received varying CVSS v3.1 severity ratings: NIST rates it as MEDIUM (Base Score: 4.9) with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H, while AMD rates it as LOW (Base Score: 1.9) with vector CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L (NVD).

The vulnerability can potentially result in a denial of service condition when successfully exploited. The impact is primarily limited to system availability, with no direct effect on confidentiality or integrity of the system (NVD).

The vulnerability requires a privileged attacker to tamper with the APCB token to force an out-of-bounds memory read. The attack requires local access and high privileges to execute (NVD).

AMD has released firmware updates to address this vulnerability. The fix is included in ROMEPI version 1.0.0.f for Rome processors and MILANPI version 1.0.0.a for Milan processors (AMD Advisory).