CVE-2021-46753 Memory corruption in Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics “Pollock”

Critical 9.1 Published 9 May 2023 Updated 28 Jan 2025

Attackers with malicious Uapp or ABL can overwrite ASP sensor fusion hub data structures, compromising confidentiality and integrity on AMD processors.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-46753?

CVE-2021-46753 is a critical memory corruption vulnerability in AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics “Pollock”, published on 9 May 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Failure to validate the length fields of the ASP (AMD Secure Processor) sensor fusion hub headers may allow an attacker with a malicious Uapp or ABL to map the ASP sensor fusion hub region and overwrite data structures leading to a potential loss of confidentiality and integrity.

Which versions are affected by CVE-2021-46753?

It affects 66 products.

Products include Amd Athlon Gold 3150g Firmware, Amd Athlon Gold 3150ge Firmware, Amd Athlon Silver 3050ge Firmware, Amd Ryzen 1200 \(Af\) Firmware, Amd Ryzen 1600 \(Af\) Firmware, Amd Ryzen 2200g Firmware and 60 more.

How do I fix CVE-2021-46753?

No fix has been published for CVE-2021-46753 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2021-46753 being exploited?

There is no known exploitation of CVE-2021-46753 in the wild and no public exploit code.

Sources

Also known as GHSA-m9pv-pmcx-jf3f.