CVE-2021-26375 Denial of service in Athlon™ Series

Medium 5.5 Published 11 May 2022 Updated 17 Sep 2024

Insufficient GPIO bounds checking in AMD SMU allows access to invalid memory, potentially causing a denial of service.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2021-26375?

CVE-2021-26375 is a medium-severity denial of service vulnerability in Amd Epyc 7232p Firmware, published on 11 May 2022. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Insufficient General Purpose IO (GPIO) bounds check in System Management Unit (SMU) may result in access/updates from/to invalid address space that could result in denial of service.

Which versions are affected by CVE-2021-26375?

It affects 83 products.

Products include Amd Epyc 7232p Firmware, Amd Epyc 7252 Firmware, Amd Epyc 7262 Firmware, Amd Epyc 7272 Firmware, Amd Epyc 7282 Firmware, Amd Epyc 72f3 Firmware and 77 more.

How do I fix CVE-2021-26375?

Apply the vendor's patch.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2021-26375 being exploited?

There is no known exploitation of CVE-2021-26375 in the wild and no public exploit code.

All Amd Epyc 7232p Firmware vulnerabilities

Sources

Also known as GHSA-xqhm-4h4h-vgmh.