CVE-2021-46754 Information disclosure in AMD Ryzen™ Embedded R1000

Critical 9.1 Published 9 May 2023 Updated 4 Aug 2024

An attacker with compromised Uapp or ABL can exploit insufficient input validation in the ASP bootloader to expose sensitive information to the SMU.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-46754?

CVE-2021-46754 is a critical vulnerability in AMD Ryzen™ Embedded R1000, published on 9 May 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Insufficient input validation in the ASP (AMD Secure Processor) bootloader may allow an attacker with a compromised Uapp or ABL to coerce the bootloader into exposing sensitive information to the SMU (System Management Unit) resulting in a potential loss of confidentiality and integrity.

Weakness: CWE-20

Which versions are affected by CVE-2021-46754?

It affects 56 products.

Products include Amd Athlon Gold 3150g Firmware, Amd Athlon Gold 3150ge Firmware, Amd Athlon Silver 3050ge Firmware, Amd Ryzen 1200 \(Af\) Firmware, Amd Ryzen 1600 \(Af\) Firmware, Amd Ryzen 2200g Firmware and 50 more.

How do I fix CVE-2021-46754?

No fix has been published for CVE-2021-46754 yet. Limit exposure of the affected software until one is available.

Is CVE-2021-46754 being exploited?

There is no known exploitation of CVE-2021-46754 in the wild and no public exploit code.

Sources

Also known as GHSA-gqvv-8rrx-g836.