CVE-2021-26380: Trusted OS Buffer Overflow Vulnerability

CVE-2021-26380 Overview

CVE-2021-26380 affects AMD platforms where a compromised Trusted OS (TOS) driver can issue a malformed call into the secure environment. The malformed call permits memory access outside the intended range, resulting in a loss of integrity. The weakness is classified under [CWE-190] Integer Overflow or Wraparound, which can cause boundary calculations to wrap and bypass intended limits. Exploitation requires local access and high privileges, which restricts the attacker population to those who have already compromised the TOS driver context.

Critical Impact

A compromised TOS driver can read or write memory outside the intended range, undermining the integrity guarantees of the Trusted OS execution environment.

Affected Products

• AMD platforms referenced in AMD Security Bulletin SB-4017
• AMD platforms referenced in AMD Security Bulletin SB-6027
• AMD Trusted OS (TOS) driver components

Discovery Timeline

• 2026-05-15 - CVE-2021-26380 published to NVD
• 2026-05-15 - Last updated in NVD database

Technical Details for CVE-2021-26380

Vulnerability Analysis

The vulnerability resides in the call interface between a Trusted OS driver and the underlying secure execution environment on affected AMD platforms. A malformed call from a compromised TOS driver is not adequately validated, allowing the driver to reference memory outside the intended bounds. The result is a loss of integrity for data structures handled within the trusted environment.

The weakness is rooted in integer handling during boundary calculations [CWE-190]. When values used to compute offsets or lengths wrap, downstream checks no longer reflect the actual memory region accessed. The flaw is local in nature and requires the attacker to already control a privileged driver, which raises the prerequisites for exploitation considerably.

No public proof-of-concept code, exploit database entry, or CISA Known Exploited Vulnerabilities listing is associated with this CVE. The EPSS probability remains very low, consistent with the high attack complexity and local access requirement.

Root Cause

The root cause is insufficient validation of parameters supplied through a TOS driver call, combined with an integer overflow condition that allows boundary computations to fall outside the legitimate range. Once the malformed parameters are accepted, memory operations proceed against an address range the driver was never intended to reach.

Attack Vector

An attacker must first compromise the TOS driver on the local system. From that position, the attacker issues a malformed call that triggers the boundary miscalculation and reaches memory outside the intended region. Network-based exploitation is not applicable. Refer to AMD Security Bulletin SB-4017 and AMD Security Bulletin SB-6027 for vendor-supplied technical context.

Detection Methods for CVE-2021-26380

Indicators of Compromise

• Unexpected loading or modification of Trusted OS driver binaries on AMD platforms.
• Anomalous calls into the TOS interface that include malformed length or offset parameters.
• Integrity check failures reported by platform firmware or secure boot telemetry.

Detection Strategies

• Monitor driver load events and verify digital signatures of TOS-related drivers against vendor baselines.
• Audit privileged process activity capable of interacting with the Trusted OS driver interface.
• Correlate firmware and platform integrity events with endpoint telemetry to identify driver tampering.

Monitoring Recommendations

• Enable kernel and driver load logging across AMD-based endpoints and forward events to a central analytics platform.
• Alert on integrity events from platform attestation or secure boot subsystems.
• Track configuration changes to driver signing enforcement and code integrity policies.

How to Mitigate CVE-2021-26380

Immediate Actions Required

• Apply firmware and driver updates referenced in AMD Security Bulletins SB-4017 and SB-6027 to affected AMD platforms.
• Restrict local administrative and driver-loading privileges to a minimal set of accounts.
• Enforce driver code signing and integrity policies on all endpoints with affected AMD components.

Patch Information

AMD has published guidance in AMD Security Bulletin SB-4017 and AMD Security Bulletin SB-6027. Administrators should apply the platform firmware and TOS driver updates supplied by the system OEM or AMD for the affected hardware families.

Workarounds

• Prevent installation of unsigned or untrusted drivers through code integrity and HVCI policies where supported.
• Limit physical and local logon access to systems running affected AMD platforms.
• Maintain a current inventory of firmware and driver versions to prioritize patch deployment.

# Verify driver signing enforcement on Windows endpoints
bcdedit /enum | findstr -i "nointegritychecks testsigning"

# Confirm AMD platform firmware version for patch tracking
wmic bios get smbiosbiosversion,manufacturer,releasedate