CVE-2021-26349
Failure to assign a new report ID to an imported guest may potentially result in an SEV-SNP guest...
5.5 Medium
Failure to assign a new report ID to an imported guest may potentially result in an SEV-SNP guest VM being tricked into trusting a dishonest Migration Agent (MA).
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
0.22%Down 0.7 points since May 12, 2022
What each source reports
NVD Score used
Failure to assign a new report ID to an imported guest may potentially result in an SEV-SNP guest VM being tricked into trusting a dishonest Migration Agent (MA).
- Record
CVE-2021-26349- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - CVSS 2.0
- 2.1 Low
AV:L/AC:L/Au:N/C:N/I:P/A:N - Updated
- 2026-11-02
CVE List No score
Failure to assign a new report ID to an imported guest may potentially result in an SEV-SNP guest VM being tricked into trusting a dishonest Migration Agent (MA).
- Record
CVE-2021-26349- Updated
- 2026-11-02
EUVDEUVD-2021-13155 No score
Failure to assign a new report ID to an imported guest may potentially result in an SEV-SNP guest VM being tricked into trusting a dishonest Migration Agent (MA).
- Record
EUVD-2021-13155- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-x34m-wh8g-2mpf
Failure to assign a new report ID to an imported guest may potentially result in an SEV-SNP guest...
Failure to assign a new report ID to an imported guest may potentially result in an SEV-SNP guest VM being tricked into trusting a dishonest Migration Agent (MA).
- Record
GHSA-x34m-wh8g-2mpf- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVSUSE-SU-2022:1751-1 No score
Security update for kernel-firmware
This update for kernel-firmware fixes the following issues:
Update AMD ucode and SEV firmware
- CVE-2021-26339, CVE-2021-26373, CVE-2021-26347, CVE-2021-26376, CVE-2021-26375, CVE-2021-26378, CVE-2021-26372, CVE-2021-26339, CVE-2021-26348, CVE-2021-26342, CVE-2021-26388, CVE-2021-26349, CVE-2021-26364, CVE-2021-26312, CVE-2021-26350, CVE-2021-46744, bsc#1199459, bsc#1199470)
Update Intel Bluetooth firmware (INTEL-SA-00604, bsc#1195786):
- CVE-2021-33139, CVE-2021-33155: Improper conditions check in the firmware for some Intel Wireless Bluetooth and Killer Bluetooth products may allow an authenticated user to potentially cause denial of service via adjacent access.
- Record
SUSE-SU-2022:1751-1- Updated
- 2026-11-02
OSVSUSE-SU-2022:1840-1 No score
Security update for kernel-firmware
This update for kernel-firmware fixes the following issues:
Update AMD ucode and SEV firmware
- (CVE-2021-26339, CVE-2021-26373, CVE-2021-26347, CVE-2021-26376, CVE-2021-26375, CVE-2021-26378, CVE-2021-26372, CVE-2021-26339, CVE-2021-26348, CVE-2021-26342, CVE-2021-26388, CVE-2021-26349, CVE-2021-26364, CVE-2021-26312, CVE-2021-26350, CVE-2021-46744, bsc#1199459, bsc#1199470)
- Record
SUSE-SU-2022:1840-1- Updated
- 2026-11-02
OSVSUSE-SU-2022:1846-1 No score
Security update for kernel-firmware
This update for kernel-firmware fixes the following issues:
Update AMD ucode and SEV firmware
- (CVE-2021-26339, CVE-2021-26373, CVE-2021-26347, CVE-2021-26376, CVE-2021-26375, CVE-2021-26378, CVE-2021-26372, CVE-2021-26339, CVE-2021-26348, CVE-2021-26342, CVE-2021-26388, CVE-2021-26349, CVE-2021-26364, CVE-2021-26312, CVE-2021-26350, CVE-2021-46744, bsc#1199459, bsc#1199470)
- Record
SUSE-SU-2022:1846-1- Updated
- 2026-11-02
OSVSUSE-SU-2022:1847-1 No score
Security update for kernel-firmware
This update for kernel-firmware fixes the following issues:
Update AMD ucode and SEV firmware
- (CVE-2021-26339, CVE-2021-26373, CVE-2021-26347, CVE-2021-26376, CVE-2021-26375, CVE-2021-26378, CVE-2021-26372, CVE-2021-26339, CVE-2021-26348, CVE-2021-26342, CVE-2021-26388, CVE-2021-26349, CVE-2021-26364, CVE-2021-26312, CVE-2021-26350, CVE-2021-46744, bsc#1199459, bsc#1199470)
- Record
SUSE-SU-2022:1847-1- Updated
- 2026-11-02
OSVSUSE-SU-2022:1923-1 No score
Security update for kernel-firmware
This update for kernel-firmware fixes the following issues:
Update to version 20220411 (git commit f219d616f42b, bsc#1199459):
- CVE-2021-26373, CVE-2021-26347, CVE-2021-26376, CVE-2021-26350, CVE-2021-26375, CVE-2021-26378, CVE-2021-26372, CVE-2021-26339, CVE-2021-26348, CVE-2021-26342, CVE-2021-26388, CVE-2021-26349, CVE-2021-26364, CVE-2021-26312: Update AMD cpu microcode
Update to version 20220309 (git commit cd01f857da28, bsc#1199470):
- CVE-2021-46744: Ciphertext Side Channels on AMD SEV
Update Intel Bluetooth firmware (INTEL-SA-00604, bsc#1195786):
- CVE-2021-33139, CVE-2021-33155: Improper conditions check in the firmware for some Intel Wireless Bluetooth and Killer Bluetooth products may allow an authenticated user to potentially cause denial of service via adjacent access.
- Record
SUSE-SU-2022:1923-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
kernel-firmwareSUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS From an advisory covering 18 CVEs |
before 20200107-150100.3.31.1 | 20200107-150100.3.31.1 |
kernel-firmwareSUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS From an advisory covering 18 CVEs |
before 20200107-150100.3.31.1 | 20200107-150100.3.31.1 |
kernel-firmwareSUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS From an advisory covering 18 CVEs |
before 20200107-150100.3.31.1 | 20200107-150100.3.31.1 |
kernel-firmwareSUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS From an advisory covering 18 CVEs |
before 20200107-150100.3.31.1 | 20200107-150100.3.31.1 |
kernel-firmwareSUSE:Linux Enterprise Server 15 SP1-BCL From an advisory covering 18 CVEs |
before 20200107-150100.3.31.1 | 20200107-150100.3.31.1 |
kernel-firmwareSUSE:Linux Enterprise Server 15 SP1-LTSS From an advisory covering 18 CVEs |
before 20200107-150100.3.31.1 | 20200107-150100.3.31.1 |
kernel-firmwareSUSE:Linux Enterprise Server 15 SP2-BCL From an advisory covering 18 CVEs |
before 20200107-150100.3.31.1 | 20200107-150100.3.31.1 |
kernel-firmwareSUSE:Linux Enterprise Server 15 SP2-LTSS From an advisory covering 18 CVEs |
before 20200107-150100.3.31.1 | 20200107-150100.3.31.1 |
kernel-firmwareSUSE:Linux Enterprise Server for SAP Applications 15 SP1 From an advisory covering 18 CVEs |
before 20200107-150100.3.31.1 | 20200107-150100.3.31.1 |
kernel-firmwareSUSE:Linux Enterprise Server for SAP Applications 15 SP2 From an advisory covering 18 CVEs |
before 20200107-150100.3.31.1 | 20200107-150100.3.31.1 |
Show 21 moreShow less
| Package | Affected | Fixed |
|---|---|---|
kernel-firmwareSUSE:Manager Proxy 4.1 From an advisory covering 18 CVEs |
before 20200107-150100.3.31.1 | 20200107-150100.3.31.1 |
kernel-firmwareSUSE:Manager Retail Branch Server 4.1 From an advisory covering 18 CVEs |
before 20200107-150100.3.31.1 | 20200107-150100.3.31.1 |
kernel-firmwareSUSE:Manager Server 4.1 From an advisory covering 18 CVEs |
before 20200107-150100.3.31.1 | 20200107-150100.3.31.1 |
kernel-firmwareSUSE:Enterprise Storage 6 From an advisory covering 18 CVEs |
before 20200107-150100.3.31.1 | 20200107-150100.3.31.1 |
kernel-firmwareSUSE:Enterprise Storage 7 From an advisory covering 18 CVEs |
before 20200107-150100.3.31.1 | 20200107-150100.3.31.1 |
kernel-firmwareSUSE:Linux Enterprise Module for Basesystem 15 SP3 From an advisory covering 15 CVEs |
before 20210208-150300.4.10.1 | 20210208-150300.4.10.1 |
kernel-firmwareSUSE:Linux Enterprise Micro 5.1 From an advisory covering 15 CVEs |
before 20210208-150300.4.10.1 | 20210208-150300.4.10.1 |
kernel-firmwareSUSE:Linux Enterprise Micro 5.2 From an advisory covering 15 CVEs |
before 20210208-150300.4.10.1 | 20210208-150300.4.10.1 |
kernel-firmwareopenSUSE:Leap 15.3 From an advisory covering 15 CVEs |
before 20210208-150300.4.10.1 | 20210208-150300.4.10.1 |
kernel-firmwareSUSE:OpenStack Cloud 9 From an advisory covering 15 CVEs |
before 20190618-5.25.2 | 20190618-5.25.2 |
kernel-firmwareSUSE:OpenStack Cloud Crowbar 9 From an advisory covering 15 CVEs |
before 20190618-5.25.2 | 20190618-5.25.2 |
kernel-firmwareSUSE:Linux Enterprise Server for SAP Applications 12 SP4 From an advisory covering 15 CVEs |
before 20190618-5.25.2 | 20190618-5.25.2 |
kernel-firmwareSUSE:Linux Enterprise Server 12 SP4-LTSS From an advisory covering 15 CVEs |
before 20190618-5.25.2 | 20190618-5.25.2 |
kernel-firmwareSUSE:Linux Enterprise Server 12 SP5 From an advisory covering 15 CVEs |
before 20190618-5.25.2 | 20190618-5.25.2 |
kernel-firmwareSUSE:Linux Enterprise Server for SAP Applications 12 SP5 From an advisory covering 15 CVEs |
before 20190618-5.25.2 | 20190618-5.25.2 |
kernel-firmwareSUSE:Linux Enterprise High Performance Computing 15-ESPOS From an advisory covering 15 CVEs |
before 20191118-150000.3.42.1 | 20191118-150000.3.42.1 |
kernel-firmwareSUSE:Linux Enterprise High Performance Computing 15-LTSS From an advisory covering 15 CVEs |
before 20191118-150000.3.42.1 | 20191118-150000.3.42.1 |
kernel-firmwareSUSE:Linux Enterprise Server 15-LTSS From an advisory covering 15 CVEs |
before 20191118-150000.3.42.1 | 20191118-150000.3.42.1 |
kernel-firmwareSUSE:Linux Enterprise Server for SAP Applications 15 From an advisory covering 15 CVEs |
before 20191118-150000.3.42.1 | 20191118-150000.3.42.1 |
kernel-firmwareSUSE:Linux Enterprise Module for Basesystem 15 SP4 From an advisory covering 17 CVEs |
before 20220509-150400.4.5.1 | 20220509-150400.4.5.1 |
kernel-firmwareopenSUSE:Leap 15.4 From an advisory covering 17 CVEs |
before 20220509-150400.4.5.1 | 20220509-150400.4.5.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-26349 is a medium vulnerability (CVSS 5.5) in Amd Epyc 72f3 Firmware, published May 11, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.22%, the 12th percentile. No source names a fixed version.
References
amd.com/en/corporate/product-security/bulletin/amd-sb-1028
nvd.nist.gov/vuln/detail/CVE-2021-26349
github.com/advisories/GHSA-x34m-wh8g-2mpf
suse.com/support/update/announcement/2022/suse-su-20221751-1
bugzilla.suse.com/1192953
Show 24 moreShow less