CVE-2021-26329 Integer overflow in 1st Gen AMD EPYC™

Medium 5.5 Published 16 Nov 2021 Updated 16 Sep 2024

An integer overflow in AMD SMU firmware allows attackers to cause resource loss and denial of service on EPYC processors.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-26329?

CVE-2021-26329 is a medium-severity vulnerability in Amd Epyc 7232p Firmware, published on 16 Nov 2021. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

AMD System Management Unit (SMU) may experience an integer overflow when an invalid length is provided which may result in a potential loss of resources.

Weakness: CWE-190, CWE-130

Which versions are affected by CVE-2021-26329?

It affects 57 products.

Products include Amd Epyc 7232p Firmware, Amd Epyc 7251 Firmware, Amd Epyc 7252 Firmware, Amd Epyc 7261 Firmware, Amd Epyc 7262 Firmware, Amd Epyc 7272 Firmware and 51 more.

How do I fix CVE-2021-26329?

No fix has been published for CVE-2021-26329 yet. Limit exposure of the affected software until one is available.

Is CVE-2021-26329 being exploited?

There is no known exploitation of CVE-2021-26329 in the wild and no public exploit code.

All Amd Epyc 7232p Firmware vulnerabilities

Sources

Also known as GHSA-mr99-xfwj-whrq.