CVE-2021-26364 Denial of service in EPYC™ Processors

Medium 5.5 Published 11 May 2022 Updated 16 Sep 2024

Insufficient bounds checking in AMD EPYC SMU mailbox allows attackers to cause denial of service via out-of-bounds reads.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2021-26364?

CVE-2021-26364 is a medium-severity denial of service vulnerability in Amd Epyc 7232p Firmware, published on 11 May 2022. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Insufficient bounds checking in an SMU mailbox register could allow an attacker to potentially read outside of the SRAM address range which could result in an exception handling leading to a potential denial of service.

Weakness: CWE-119

Which versions are affected by CVE-2021-26364?

It affects 44 products.

Products include Amd Epyc 7232p Firmware, Amd Epyc 7252 Firmware, Amd Epyc 7262 Firmware, Amd Epyc 7272 Firmware, Amd Epyc 7282 Firmware, Amd Epyc 72f3 Firmware and 38 more.

How do I fix CVE-2021-26364?

Apply the vendor's patch.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2021-26364 being exploited?

There is no known exploitation of CVE-2021-26364 in the wild and no public exploit code.

All Amd Epyc 7232p Firmware vulnerabilities

Sources

Also known as GHSA-q56v-q98x-mc7h.