CVE-2021-26341 Information disclosure in AMD Processors

Medium 6.5 Published 11 Mar 2022 Updated 16 Sep 2024

Attackers can exploit transient execution beyond unconditional branches on AMD CPUs to leak sensitive data.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2021-26341?

CVE-2021-26341 is a medium-severity vulnerability in Amd Epyc 7232p Firmware, published on 11 Mar 2022. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage.

Weakness: CWE-212

Which versions are affected by CVE-2021-26341?

It affects 126 products.

Products include Amd A10-9600p Firmware, Amd A10-9630p Firmware, Amd A12-9700p Firmware, Amd A12-9730p Firmware, Amd A4-9120 Firmware, Amd A6-9210 Firmware and 120 more.

How do I fix CVE-2021-26341?

Apply the vendor's patch.

Is CVE-2021-26341 being exploited?

There is no known exploitation of CVE-2021-26341 in the wild and no public exploit code.

All Amd Epyc 7232p Firmware vulnerabilities

Sources

Also known as GHSA-r3q4-4jhx-x4c9.