Vulnerability Description
Insufficient input validation in the ASP (AMD Secure Processor) bootloader may allow an attacker with a compromised Uapp or ABL to coerce the bootloader into exposing sensitive information to the SMU (System Management Unit) resulting in a potential loss of confidentiality and integrity.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Amd | Ryzen 5300G Firmware | cezannepi-fp6_1.0.0.6 |
| Amd | Ryzen 5300G | - |
| Amd | Ryzen 5300Ge Firmware | cezannepi-fp6_1.0.0.6 |
| Amd | Ryzen 5300Ge | - |
| Amd | Ryzen 5500 Firmware | cezannepi-fp6_1.0.0.6 |
| Amd | Ryzen 5500 | - |
| Amd | Ryzen 5600 Firmware | cezannepi-fp6_1.0.0.6 |
| Amd | Ryzen 5600 | - |
| Amd | Ryzen 5600G Firmware | cezannepi-fp6_1.0.0.6 |
| Amd | Ryzen 5600G | - |
| Amd | Ryzen 5600Ge Firmware | cezannepi-fp6_1.0.0.6 |
| Amd | Ryzen 5600Ge | - |
| Amd | Ryzen 5600X Firmware | cezannepi-fp6_1.0.0.6 |
| Amd | Ryzen 5600X | - |
| Amd | Ryzen 5700G Firmware | cezannepi-fp6_1.0.0.6 |
| Amd | Ryzen 5700G | - |
| Amd | Ryzen 5700Ge Firmware | cezannepi-fp6_1.0.0.6 |
| Amd | Ryzen 5700Ge | - |
| Amd | Ryzen 5700X Firmware | cezannepi-fp6_1.0.0.6 |
| Amd | Ryzen 5700X | - |
Related Weaknesses (CWE)
References
- https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-4001Vendor Advisory
- https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-5001
- https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-4001Vendor Advisory
- https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-5001
FAQ
What is CVE-2021-46754?
CVE-2021-46754 is a vulnerability with a CVSS score of 9.1 (CRITICAL). Insufficient input validation in the ASP (AMD Secure Processor) bootloader may allow an attacker with a compromised Uapp or ABL to coerce the bootloader into exposing sensitive information to the SMU ...
How severe is CVE-2021-46754?
CVE-2021-46754 has been rated CRITICAL with a CVSS base score of 9.1/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2021-46754?
Check the references section above for vendor advisories and patch information. Affected products include: Amd Ryzen 5300G Firmware, Amd Ryzen 5300G, Amd Ryzen 5300Ge Firmware, Amd Ryzen 5300Ge, Amd Ryzen 5500 Firmware.