CVE-2021-46772

State: Published
Severity: 3.9 Low
Published: Aug 13, 2024
Updated: Nov 5, 2024
Reserved: Mar 31, 2022

Description

Insufficient input validation in the ABL may allow a privileged attacker with access to the BIOS menu or UEFI shell to tamper with the structure headers in SPI ROM causing an out of bounds memory read and write, potentially resulting in memory corruption or denial of service.

Scores

CVSS	Score	Vector	Source
3.1	3.9 Low	CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:L	AMD

Weaknesses

CWE-125 Out-of-bounds Read
CWE-787 Out-of-bounds Write

Affected Products

Product	Versions
AMD EPYC™ 7002 Series ProcessorsAMD	RomePI 1.0.0.ENot affected
AMD EPYC™ 7003 Series ProcessorsAMD	MilanPI 1.0.0.9Not affected
AMD Ryzen™ 3000 Series Desktop ProcessorsAMD	variousAffected
AMD Ryzen™ 5000 Series Desktop ProcessorsAMD	ComboAM4V2 1.2.0.ANot affected
AMD Ryzen™ 5000 Series Desktop Processor with Radeon™ GraphicsAMD	ComboAM4V2 1.2.0.AAffected
AMD Athlon™ 3000 Series Desktop Processors with Radeon™ GraphicsAMD	variousAffected
AMD Ryzen™ 4000 Series Desktop Processors with Radeon™ GraphicsAMD	variousAffected
AMD Ryzen™ Threadripper™ 3000 Series ProcessorsAMD	variousAffected
AMD Ryzen™ Threadripper™ PRO 3000WX Series ProcessorsAMD	ChagallWSPI-sWRX8 1.0.0.6Not affected
AMD Ryzen™ Threadripper™ PRO 5000WX ProcessorsAMD	ChagallWSPI-sWRX8 1.0.0.6Not affected
AMD Athlon™ 3000 Series Mobile Processors with Radeon™ GraphicsAMD	variousAffected
AMD Athlon™ 3000 Series Mobile Processors with Radeon™ GraphicsAMD	variousAffected
AMD Ryzen™ 3000 Series Mobile Processor with Radeon™ GraphicsAMD	variousAffected
AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ GraphicsAMD	variousAffected
AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ GraphicsAMD	variousAffected
AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ GraphicsAMD	CezannePI-FP6 1.0.0.ENot affected
AMD Ryzen™ 7020 Series Processors with Radeon™ GraphicsAMD	MendocinoPI-FT6 1.0.0.3Not affected
AMD Ryzen™ 6000 Series Processors with Radeon™ GraphicsAMD	RembrandtPI-FP7 1.0.0.7Not affected
AMD Ryzen™ 7035 Series Processors with Radeon™ GraphicsAMD	RembrandtPI-FP7 1.0.0.7Not affected
AMD Ryzen™ 5000 Series Processors with Radeon™ GraphicsAMD	CezannePI-FP6 1.0.0.ENot affected
AMD Ryzen™ 3000 Series Processors with Radeon™ GraphicsAMD	CezannePI-FP6 1.0.0.ENot affected
AMD EPYC™ Embedded 7002 Series ProcessorsAMD	EmbRomePI-SP3 1.0.0.8Not affected
AMD EPYC™ Embedded 7003 Series ProcessorsAMD	EmbMilanPI-SP3 1.0.0.5Not affected
AMD Ryzen™ Embedded R1000 Series ProcessorsAMD	variousAffected
AMD Ryzen™ Embedded R2000 Series ProcessorsAMD	variousAffected
AMD Ryzen™ Embedded 5000 Series ProcessorsAMD	variousAffected
AMD Ryzen™ Embedded V1000 Series ProcessorsAMD	variousAffected
AMD Ryzen™ Embedded V2000 Series ProcessorsAMD	variousAffected
AMD Ryzen™ Embedded V3000 Series ProcessorsAMD	EmbeddedPI-FP7r2 1.0.0.4Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.