PT-2024-11054 · Amd · Amd Athlon™ 3000 Series Desktop Processors With Radeon™ Graphics+22

Published 2024-08-13 · Updated 2024-11-05 · CVE-2021-46772

Positive Technologies (AI Summary)

CVSS v3.1

3.9

Low

Base vector

AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Insufficient information is provided to determine the specific software and versions affected.

Description The issue is related to insufficient input validation in the ABL, which may allow a privileged attacker with access to the BIOS menu or UEFI shell to tamper with the structure headers in SPI ROM. This could result in an out of bounds memory read and write, potentially causing memory corruption or denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Out of bounds Read

Memory Corruption

Weakness Enumeration

CWE-125

CWE-787

Related Identifiers

CVE-2021-46772

Affected Products

Amd Athlon™ 3000 Series Desktop Processors With Radeon™ Graphics

Amd Athlon™ 3000 Series Mobile Processors With Radeon™ Graphics

Amd Epyc™ 7002 Series Processors

Amd Epyc™ 7003 Series Processors

Amd Epyc™ Embedded 7002 Series Processors

Amd Epyc™ Embedded 7003 Series Processors

Amd Ryzen™ 3000 Series Desktop Processors

Amd Ryzen™ 3000 Series Mobile Processor With Radeon™ Graphics

Amd Ryzen™ 3000 Series Processors With Radeon™ Graphics

Amd Ryzen™ 4000 Series Desktop Processor With Radeon™ Graphics

Amd Ryzen™ 4000 Series Mobile Processors With Radeon™ Graphics

Amd Ryzen™ 5000 Series Desktop Processor With Radeon™ Graphics

Amd Ryzen™ 5000 Series Desktop Processors

Amd Ryzen™ 5000 Series Processors With Radeon™ Graphics

Amd Ryzen™ 6000 Series Processor With Radeon™ Graphics

Amd Ryzen™ 7020 Series Processors With Radeon™ Graphics

Amd Ryzen™ 7035 Series Processor With Radeon™ Graphics

Amd Ryzen™ Embedded 5000 Series Processors

Amd Ryzen™ Embedded R1000 Series Processors

Amd Ryzen™ Embedded R2000 Series Processors

Amd Ryzen™ Embedded V3000 Series Processors

Amd Ryzen™ Threadripper™ 3000 Series Processors

Amd Ryzen™ Threadripper™ Pro 5000Wx Processors

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2021-46772 · Security Note
• https://amd.com/en/resources/product-security/bulletin/amd-sb-3003.html · Vendor Advisory
• https://twitter.com/PorsilapongoCl/status/1823409384745058526 · Twitter Post
• https://amd.com/en/resources/product-security/bulletin/amd-sb-5002.html · Note
• https://twitter.com/CVEnew/status/1823407767434010830 · Twitter Post
• https://t.me/cvenotify/90441 · Telegram Post
• https://amd.com/en/resources/product-security/bulletin/amd-sb-4004.html · Note