CVE-2021-46755 Denial of service in 3rd Gen AMD Ryzen™ Threadripper™ Processors “Castle Peak” HEDT

High 7.5 Published 9 May 2023 Updated 28 Jan 2025

A malicious bootloader can exhaust SysHub resources in AMD Secure Processor, causing denial of service on affected Ryzen processors.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-46755?

CVE-2021-46755 is a high-severity denial of service vulnerability in 3rd Gen AMD Ryzen™ Threadripper™ Processors “Castle Peak” HEDT, published on 9 May 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Failure to unmap certain SysHub mappings in error paths of the ASP (AMD Secure Processor) bootloader may allow an attacker with a malicious bootloader to exhaust the SysHub resources resulting in a potential denial of service.

Which versions are affected by CVE-2021-46755?

It affects 23 products.

Products include Amd Ryzen 3100 Firmware, Amd Ryzen 3300x Firmware, Amd Ryzen 3500 Firmware, Amd Ryzen 3500x Firmware, Amd Ryzen 3600 Firmware, Amd Ryzen 3600x Firmware and 17 more.

How do I fix CVE-2021-46755?

No fix has been published for CVE-2021-46755 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2021-46755 being exploited?

There is no known exploitation of CVE-2021-46755 in the wild and no public exploit code.

Sources

Also known as GHSA-xpf2-4v7h-fpcm.