CVE-2021-26368 Privilege escalation in Athlon™ Series
An attacker with privileges can unmap memory of higher-privileged processes in AMD Trusted OS, causing denial of service and potential privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-26368?
CVE-2021-26368 is a medium-severity vulnerability in AMD Athlon™ Series, published on 12 May 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Insufficient check of the process type in Trusted OS (TOS) may allow an attacker with privileges to enable a lesser privileged process to unmap memory owned by a higher privileged process resulting in a denial of service.
Weakness: CWE-345
Which versions are affected by CVE-2021-26368?
It affects 70 products.
Products include Amd Ryzen 3 2200u Firmware, Amd Ryzen 3 2300u Firmware, Amd Ryzen 3 3100 Firmware, Amd Ryzen 3 3300g Firmware, Amd Ryzen 3 3300x Firmware, Amd Ryzen 3 5125c Firmware and 64 more.
How do I fix CVE-2021-26368?
No fix has been published for CVE-2021-26368 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-26368 being exploited?
There is no known exploitation of CVE-2021-26368 in the wild and no public exploit code.
Other vulnerabilities in AMD Athlon™ Series
Sources
Also known as GHSA-q98f-vpvc-2r7r.