by Kastro
Paper/Archive/CVE-2021-46753

CVE-2021-46753

AMD Ryzen™ 2000 series Desktop Processors “Raven Ridge” AM4 — Failure to validate the length fields of the ASP (AMD Secure Processor) sensor fusion hub headers may allow an attacker with a malicious…

EPSS 0.6%CVSS 9.1
critical.is priorityof 100
37
CVSS 9.1 (NVD, ADP agree)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 46.6.466 × 209.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Failure to validate the length fields of the ASP (AMD Secure Processor) sensor fusion hub headers may allow an attacker with a malicious Uapp or ABL to map the ASP sensor fusion hub region and overwrite data structures leading to a potential loss of confidentiality and integrity.

Affected

ProductAffectedFixed inSource
Ryzen™ 2000 series Desktop Processors “Raven Ridge” AM4various –CNA
Ryzen™ 5000 Series Desktop processor with Radeon™ Graphics “Cezanne” AM4various –CNA
Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics “Dali”/”Dali” ULPvarious –CNA
Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics “Pollock”various –CNA
Ryzen™ 2000 Series Mobile Processors “Raven Ridge” FP5various –CNA
Ryzen™ 3000 Series Mobile processor, 2nd Gen AMD Ryzen™ Mobile Processors with Radeon™ Graphics “Picasso”various –CNA
Ryzen™ 3000 Series Mobile Processors with Radeon™ Graphics “Renoir”various –CNA
Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics “Lucienne”various –CNA
Ryzen™ 5000 Series Mobile processors with Radeon™ Graphics “Cezanne”various –CNA
Ryzen™ 6000 Series Mobile Processors "Rembrandt"various –CNA

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisoryamd.com/en/corporate/product-security/bulletin/AMD-SB-4001