by Kastro
Paper/Archive/CVE-2021-46754

CVE-2021-46754

AMD Ryzen™ 2000 series Desktop Processors “Raven Ridge” AM4 — Insufficient input validation in the ASP (AMD Secure Processor) bootloader may allow an attacker with a compromised Uapp or ABL to coerce…

EPSS 0.6%CVSS 9.1
critical.is priorityof 100
37
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 47.0.470 × 209.4No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Insufficient input validation in the ASP (AMD Secure Processor) bootloader may allow an attacker with a compromised Uapp or ABL to coerce the bootloader into exposing sensitive information to the SMU (System Management Unit) resulting in a potential loss of confidentiality and integrity.

Affected

ProductAffectedFixed inSource
Ryzen™ 2000 series Desktop Processors “Raven Ridge” AM4various –CNA
Ryzen™ 5000 Series Desktop processor with Radeon™ Graphics “Cezanne” AM4various –CNA
Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics “Dali”/”Dali” ULPvarious –CNA
Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics “Pollock”various –CNA
Ryzen™ 2000 Series Mobile Processors “Raven Ridge” FP5various –CNA
Ryzen™ 3000 Series Mobile processor, 2nd Gen AMD Ryzen™ Mobile Processors with Radeon™ Graphics “Picasso”various –CNA
Ryzen™ 3000 Series Mobile Processors with Radeon™ Graphics “Renoir”various –CNA
Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics “Lucienne”various –CNA
Ryzen™ 5000 Series Mobile processors with Radeon™ Graphics “Cezanne”various –CNA
AMD Ryzen™ Embedded R1000various–CNA
AMD Ryzen™ Embedded R2000various–CNA
AMD Ryzen™ Embedded V1000various–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

advisoryamd.com/en/corporate/product-security/bulletin/AMD-SB-4001refamd.com/en/corporate/product-security/bulletin/AMD-SB-5001