7.5 High

CVE-2021-46749 Insufficient bounds checking in ASP (AMD Secure Processor) may allow for an out of bounds read in SMI (System Management…

Description

Insufficient bounds checking in ASP (AMD Secure Processor) may allow for an out of bounds read in SMI (System Management Interface) mailbox checksum calculation triggering a data abort, resulting in a potential denial of service.

Affected products and versions

Product	Affected versions	Fixed in
Ryzen™ 2000 Series Desktop Processors “Pinnacle Ridge”	Versions not published
Ryzen™ 3000 Series Desktop Processors “Matisse” AM4	Versions not published
AMD Ryzen™ 5000 Series Desktop Processors “Vermeer” AM4	Versions not published
Ryzen™ 5000 Series Desktop processor with Radeon™ Graphics “Cezanne” AM4	Versions not published
3rd Gen AMD Ryzen™ Threadripper™ Processors “Castle Peak” HEDT	Versions not published
Ryzen™ Threadripper™ PRO Processors “Castle Peak” WS	Versions not published
Ryzen™ Threadripper™ PRO Processors “Chagall” WS	Versions not published
Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics “Dali”/”Dali” ULP	Versions not published
Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics “Pollock”	Versions not published

Show the 5 other branches

Product	Affected versions	Fixed in
Ryzen™ 2000 Series Mobile Processors “Raven Ridge” FP5	Versions not published
Ryzen™ 3000 Series Mobile processor, 2nd Gen AMD Ryzen™ Mobile Processors with Radeon™ Graphics “Picasso”	Versions not published
Ryzen™ 3000 Series Mobile Processors with Radeon™ Graphics “Renoir”	Versions not published
Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics “Lucienne”	Versions not published
Ryzen™ 5000 Series Mobile processors with Radeon™ Graphics “Cezanne”	Versions not published

References

www.amd.com www.amd.com

Timeline

Published May 9, 2023
Last modified January 28, 2025

The 5 CVEs of Ryzen™ 2000 Series Desktop Processors “Pinnacle Ridge” →

CVE-2021-46773 Insufficient input validation in ABL may enable a privileged attacker to corrupt ASP memory, potentially resulting in… 8.8 High CVE-2021-46756 Insufficient validation of inputs in SVC_MAP_USER_STACK in the ASP (AMD Secure Processor) bootloader may allow an… 9.1 Critical CVE-2021-26406 Insufficient validation in parsing Owner's Certificate Authority (OCA) certificates in SEV (AMD Secure Encrypted… 7.5 High CVE-2021-26354 Insufficient bounds checking in ASP may allow an attacker to issue a system call from a compromised ABL which may… 5.5 Medium

Track this CVE