7.5 High

CVE-2021-46794 Insufficient bounds checking in ASP (AMD Secure Processor) may allow for an out of bounds read in SMI (System Management…

Description

Insufficient bounds checking in ASP (AMD Secure Processor) may allow for an out of bounds read in SMI (System Management Interface) mailbox checksum calculation triggering a data abort, resulting in a potential denial of service.

Affected products and versions

Product	Affected versions	Fixed in
Ryzen™ 2000 series Desktop Processors “Raven Ridge” AM4	Versions not published
Ryzen™ 3000 Series Desktop Processors “Matisse” AM4	Versions not published
AMD Ryzen™ 5000 Series Desktop Processors “Vermeer” AM4	Versions not published
Ryzen™ 5000 Series Desktop processor with Radeon™ Graphics “Cezanne” AM4	Versions not published
3rd Gen AMD Ryzen™ Threadripper™ Processors “Castle Peak” HEDT	Versions not published
Ryzen™ Threadripper™ PRO Processors “Castle Peak” WS	Versions not published
Ryzen™ Threadripper™ PRO Processors “Chagall” WS	Versions not published
Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics “Dali”/”Dali” ULP	Versions not published
Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics “Pollock”	Versions not published

Show the 5 other branches

Product	Affected versions	Fixed in
Ryzen™ 2000 Series Mobile Processors “Raven Ridge” FP5	Versions not published
Ryzen™ 3000 Series Mobile processor, 2nd Gen AMD Ryzen™ Mobile Processors with Radeon™ Graphics “Picasso”	Versions not published
Ryzen™ 3000 Series Mobile Processors with Radeon™ Graphics “Renoir”	Versions not published
Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics “Lucienne”	Versions not published
Ryzen™ 5000 Series Mobile processors with Radeon™ Graphics “Cezanne”	Versions not published

References

www.amd.com www.amd.com

Timeline

Published May 9, 2023
Last modified January 28, 2025

The 11 CVEs of Ryzen™ 2000 series Desktop Processors “Raven Ridge” AM4 →

CVE-2021-46792 Time-of-check Time-of-use (TOCTOU) in the BIOS2PSP command may allow an attacker with a malicious BIOS to create a… 5.9 Medium CVE-2021-46773 Insufficient input validation in ABL may enable a privileged attacker to corrupt ASP memory, potentially resulting in… 8.8 High CVE-2021-46759 Improper syscall input validation in AMD TEE (Trusted Execution Environment) may allow an attacker with physical… 6.1 Medium CVE-2021-46756 Insufficient validation of inputs in SVC_MAP_USER_STACK in the ASP (AMD Secure Processor) bootloader may allow an… 9.1 Critical

Track this CVE