Medium severity · published May 12, 2022
CVE-2021-26363
A malicious or compromised UApp or ABL could potentially change the value that the ASP uses for its reserved DRAM, to one outside of the fenced area, potentially leading to data…
4.4
CVSS
0.2%
EPSS
No
On KEV
Description
A malicious or compromised UApp or ABL could potentially change the value that the ASP uses for its reserved DRAM, to one outside of the fenced area, potentially leading to data exposure.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 12% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RS
Radeon Software · Amd
All versions, or not specified · source: NVD
R3
Ryzen 3 3100 Firmware · Amd
All versions, or not specified · source: NVD
R3
Ryzen 3 3300g Firmware · Amd
All versions, or not specified · source: NVD
R3
Ryzen 3 3300x Firmware · Amd
All versions, or not specified · source: NVD
R3
Ryzen 3 5125c Firmware · Amd
All versions, or not specified · source: NVD
R3
Ryzen 3 5400u Firmware · Amd
All versions, or not specified · source: NVD
R3
Ryzen 3 5425c Firmware · Amd
All versions, or not specified · source: NVD
R3
Ryzen 3 5425u Firmware · Amd
All versions, or not specified · source: NVD
R5
Ryzen 5 3400g Firmware · Amd
All versions, or not specified · source: NVD
R5
Ryzen 5 3450g Firmware · Amd
All versions, or not specified · source: NVD
R5
Ryzen 5 3600 Firmware · Amd
All versions, or not specified · source: NVD
R5
Ryzen 5 3600x Firmware · Amd
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-26363
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-26363
Vendor Advisory
https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1027
More from Radeon Software
9.8
CVE-2023-20586
A potential vulnerability was reported in Radeon™ Software Crimson ReLive Edition which may allow escalation of privilege
7.8
CVE-2024-36333
A DLL hijacking vulnerability in the AMD Cleanup Utility could allow an attacker to achieve privilege escalation potentially resulting in arbitrary code execution
7.8
CVE-2023-20548
A Time-of-check time-of-use (TOCTOU) race condition in the AMD Secure Processor (ASP) could allow an attacker to corrupt memory resulting in loss of integrity, confidentiality, or…
7.8
CVE-2023-31324
A Time-of-check time-of-use (TOCTOU) race condition in the AMD Secure Processor (ASP) could allow an attacker to modify External Global Memory Interconnect Trusted Agent (XGMI TA)…
7.8
CVE-2024-21937
Incorrect default permissions in the AMD HIP SDK installation directory could allow an attacker to achieve privilege escalation potentially resulting in arbitrary code execution