CVE-2021-26339 Denial of service in Athlon™ Series

Medium 5.5 Published 11 May 2022 Updated 17 Sep 2024

An attacker in an unprivileged VM can trigger a CPU core hang via specific x86 instructions, causing denial of service on AMD processors.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2021-26339?

CVE-2021-26339 is a medium-severity denial of service vulnerability in Amd Epyc 72f3 Firmware, published on 11 May 2022. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A bug in AMD CPU’s core logic may allow for an attacker, using specific code from an unprivileged VM, to trigger a CPU core hang resulting in a potential denial of service. AMD believes the specific code includes a specific x86 instruction sequence that would not be generated by compilers.

Which versions are affected by CVE-2021-26339?

It affects 84 products.

Products include Amd Epyc 72f3 Firmware, Amd Epyc 7313 Firmware, Amd Epyc 7313p Firmware, Amd Epyc 7343 Firmware, Amd Epyc 7373x Firmware, Amd Epyc 73f3 Firmware and 78 more.

How do I fix CVE-2021-26339?

Apply the vendor's patch.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2021-26339 being exploited?

There is no known exploitation of CVE-2021-26339 in the wild and no public exploit code.

All Amd Epyc 72f3 Firmware vulnerabilities

Sources

Also known as GHSA-jp8x-pjv8-649v.