What’s Vulnerable › Vulnerabilities

CVE-2018-8930

• Severity: critical (CVSS 9.0 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-03-22 · updated 2026-06-17

Description

The AMD EPYC Server, Ryzen, Ryzen Pro, and Ryzen Mobile processor chips have insufficient enforcement of Hardware Validated Boot, aka MASTERKEY-1, MASTERKEY-2, and MASTERKEY-3.

Affected products

• AMD Epyc Server Firmware: all versions
• AMD Ryzen Firmware: all versions
• AMD Ryzen Mobile Firmware: all versions
• AMD Ryzen Pro Firmware: all versions

References

• https://amdflaws.com/
• https://blog.trailofbits.com/2018/03/15/amd-flaws-technical-summary/
• https://community.amd.com/community/amd-corporate/blog/2018/03/21/initial-amd-technical-assessment-of-cts-labs-research
• https://safefirmware.com/amdflaws_whitepaper.pdf
• https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03841en_us
• https://amdflaws.com/
• https://blog.trailofbits.com/2018/03/15/amd-flaws-technical-summary/
• https://community.amd.com/community/amd-corporate/blog/2018/03/21/initial-amd-technical-assessment-of-cts-labs-research
• https://safefirmware.com/amdflaws_whitepaper.pdf
• https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03841en_us

Get alerted when CVE-2018-8930 or the next vulnerability affects your stack