CVE-2021-26373 Denial of service in Athlon™ Series

Medium 5.5 Published 11 May 2022 Updated 16 Sep 2024

Insufficient bound checks in AMD SMU firmware allow attackers to cause system voltage malfunctions, leading to denial of service.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2021-26373?

CVE-2021-26373 is a medium-severity denial of service vulnerability in Amd Epyc 7232p Firmware, published on 11 May 2022. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Insufficient bound checks in the System Management Unit (SMU) may result in a system voltage malfunction that could result in denial of resources and/or possibly denial of service.

Weakness: CWE-20

Which versions are affected by CVE-2021-26373?

It affects 87 products.

Products include Amd Epyc 7232p Firmware, Amd Epyc 7252 Firmware, Amd Epyc 7262 Firmware, Amd Epyc 7272 Firmware, Amd Epyc 7282 Firmware, Amd Epyc 72f3 Firmware and 81 more.

How do I fix CVE-2021-26373?

Apply the vendor's patch.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2021-26373 being exploited?

There is no known exploitation of CVE-2021-26373 in the wild and no public exploit code.

All Amd Epyc 7232p Firmware vulnerabilities

Sources

Also known as GHSA-mphm-w367-mf6q.