Skip to content
fr Sign in
5.5 Medium

CVE-2021-26371 A compromised or malicious ABL or UApp could send a SHA256 system call to the bootloader, which may result in exposure…

Description

A compromised or malicious ABL or UApp could send a SHA256 system call to the bootloader, which may result in exposure of ASP memory to userspace, potentially leading to information disclosure.

Affected products and versions

Product Affected versions Fixed in
Ryzen™ 2000 series Desktop Processors “Raven Ridge” AM4 Versions not published
Ryzen™ 3000 Series Desktop Processors “Matisse” AM4 Versions not published
AMD Ryzen™ 5000 Series Desktop Processors “Vermeer” AM4 Versions not published
3rd Gen AMD Ryzen™ Threadripper™ Processors “Castle Peak” HEDT Versions not published
Ryzen™ Threadripper™ PRO Processors “Castle Peak” WS Versions not published
Ryzen™ Threadripper™ PRO Processors “Chagall” WS Versions not published
Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics “Dali”/”Dali” ULP Versions not published
Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics “Pollock” Versions not published
Ryzen™ 2000 Series Mobile Processors “Raven Ridge” FP5 Versions not published
Show the 4 other branches
Product Affected versions Fixed in
Ryzen™ 3000 Series Mobile processor, 2nd Gen AMD Ryzen™ Mobile Processors with Radeon™ Graphics “Picasso” Versions not published
1st Gen AMD EPYC™ Processors Versions not published
2nd Gen AMD EPYC™ Processors Versions not published
3rd Gen AMD EPYC™ Processors Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Ryzen™ 2000 series Desktop Processors “Raven Ridge” AM4

The 11 CVEs of Ryzen™ 2000 series Desktop Processors “Raven Ridge” AM4 →
CVE-2021-46794 Insufficient bounds checking in ASP (AMD Secure Processor) may allow for an out of bounds read in SMI (System Management… 7.5 High CVE-2021-46792 Time-of-check Time-of-use (TOCTOU) in the BIOS2PSP command may allow an attacker with a malicious BIOS to create a… 5.9 Medium CVE-2021-46773 Insufficient input validation in ABL may enable a privileged attacker to corrupt ASP memory, potentially resulting in… 8.8 High CVE-2021-46759 Improper syscall input validation in AMD TEE (Trusted Execution Environment) may allow an attacker with physical… 6.1 Medium
Track this CVE