CVE-2021-26345 Memory corruption in 2nd Gen AMD EPYC™ Processors
A privileged attacker can tamper with APCB tokens to cause an out-of-bounds memory read, leading to a denial of service on AMD EPYC processors.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-26345?
CVE-2021-26345 is a low-severity memory corruption vulnerability in Amd Epyc 7232p Firmware, published on 14 Nov 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Failure to validate the value in APCB may allow a privileged attacker to tamper with the APCB token to force an out-of-bounds memory read potentially resulting in a denial of service.
Weakness: CWE-125
Which versions are affected by CVE-2021-26345?
It affects 90 products.
Products include Amd Epyc 7203 Firmware, Amd Epyc 7203p Firmware, Amd Epyc 7232p Firmware, Amd Epyc 7252 Firmware, Amd Epyc 7262 Firmware, Amd Epyc 7272 Firmware and 84 more.
How do I fix CVE-2021-26345?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2021-26345 being exploited?
There is no known exploitation of CVE-2021-26345 in the wild and no public exploit code.
Other vulnerabilities in Amd Epyc 7232p Firmware
- CVE-2024-21980 Memory corruption in 3rd Gen AMD EPYC™ Processors
- CVE-2023-20591 Other in AMD EPYC™ 7003 Series Processors
- CVE-2023-20533 Denial of service in 2nd Gen AMD EPYC™ Processors
- CVE-2023-31355 Memory corruption in 3rd Gen AMD EPYC™ Processors
- CVE-2024-21978 Information disclosure in 3rd Gen AMD EPYC™ Processors
Sources
Also known as GHSA-vgxm-8jf8-3h3v.