CVE-2018-8931 The AMD Ryzen, Ryzen Pro, and Ryzen Mobile processor chips have insufficient access control for the Secure Processor, aka RYZENFALL-1.

CriticalCVSS 9.0 EPSS 1.7%

Published: 2018-03-22 16:00
Updated: 2026-06-17 05:05
Exploit status: No public exploit known

Sign in for asset impact Search another CVE

Description

The AMD Ryzen, Ryzen Pro, and Ryzen Mobile processor chips have insufficient access control for the Secure Processor, aka RYZENFALL-1.

Affected products

Product	Affected versions	Fixed in
amd ryzen mobile firmware	All versions	No fix listed
amd ryzen pro firmware	All versions	No fix listed
amd ryzen firmware	All versions	No fix listed

References

amdflaws.com third-party-advisory
blog.trailofbits.com third-party-advisory
community.amd.com vendor-advisory
safefirmware.com third-party-advisory

CVSS v3.0

9.0 Critical

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector: Network
Attack Complexity: High
Privileges Required: None
User Interaction: None
Scope: Changed
Confidentiality: High
Integrity: High
Availability: High

All scores (2)

v3.0 9.0 · nvd@nist.gov
v2.0 9.3 · nvd@nist.gov

Weakness & likelihood

EPSS (exploitation probability, 30 days): 1.66% (percentile 77.0)
CWE: CWE-732

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.