Medium severity · published Jan 11, 2023
CVE-2021-26346
Failure to validate the integer operand in ASP (AMD Secure Processor) bootloader may allow an attacker to introduce an integer overflow in the L2 directory table in SPI flash…
5.5
CVSS
0.2%
EPSS
No
On KEV
Description
Failure to validate the integer operand in ASP (AMD Secure Processor) bootloader may allow an attacker to introduce an integer overflow in the L2 directory table in SPI flash resulting in a potential denial of service.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 12% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
R3
Ryzen 3 3100 Firmware · Amd
All versions, or not specified · source: NVD
R3
Ryzen 3 3200g Firmware · Amd
All versions, or not specified · source: NVD
R3
Ryzen 3 3200u Firmware · Amd
All versions, or not specified · source: NVD
R3
Ryzen 3 3250c Firmware · Amd
All versions, or not specified · source: NVD
R3
Ryzen 3 3250u Firmware · Amd
All versions, or not specified · source: NVD
R3
Ryzen 3 3300g Firmware · Amd
All versions, or not specified · source: NVD
R3
Ryzen 3 3300u Firmware · Amd
All versions, or not specified · source: NVD
R3
Ryzen 3 3300x Firmware · Amd
All versions, or not specified · source: NVD
R3
Ryzen 3 3350u Firmware · Amd
All versions, or not specified · source: NVD
R3
Ryzen 3 3450u Firmware · Amd
All versions, or not specified · source: NVD
R3
Ryzen 3 3500c Firmware · Amd
All versions, or not specified · source: NVD
R3
Ryzen 3 3500u Firmware · Amd
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-26346
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-26346
Vendor Advisory
https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1031
More from Ryzen 3 3100 Firmware
9.8
CVE-2022-23821
Improper access control in System Management Mode (SMM) may allow an attacker to write to SPI ROM potentially leading to arbitrary code execution
9.8
CVE-2022-23820
Failure to validate the AMD SMM communication buffer may allow an attacker to corrupt the SMRAM potentially leading to arbitrary code execution
7.8
CVE-2021-26392
Insufficient verification of missing size check in 'LoadModule' may lead to an out-of-bounds write potentially allowing an attacker with privileges to gain code execution of the…
7.8
CVE-2020-12931
Improper parameters handling in the AMD Secure Processor (ASP) kernel may allow a privileged attacker to elevate their privileges potentially leading to loss of integrity
7.8
CVE-2020-12930
Improper parameters handling in AMD Secure Processor (ASP) drivers may allow a privileged attacker to elevate their privileges potentially leading to loss of integrity