CVE-2021-46758 Information disclosure in AMD Ryzen™ 5000 Series Processors with Radeon™ Graphics “Barcelo”
An attacker can read memory beyond SPI flash due to insufficient address validation in the AMD Secure Processor bootloader, risking data exposure and system integrity.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-46758?
CVE-2021-46758 is a medium-severity vulnerability in AMD Ryzen™ 5000 Series Processors with Radeon™ Graphics “Barcelo”, published on 14 Nov 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Insufficient validation of SPI flash addresses in the ASP (AMD Secure Processor) bootloader may allow an attacker to read data in memory mapped beyond SPI flash resulting in a potential loss of availability and integrity.
Which versions are affected by CVE-2021-46758?
It affects 61 products.
Products include Amd Ryzen 3 4300u Firmware, Amd Ryzen 3 5125c Firmware, Amd Ryzen 3 5300g Firmware, Amd Ryzen 3 5300ge Firmware, Amd Ryzen 3 5300u Firmware, Amd Ryzen 3 5400u Firmware and 55 more.
How do I fix CVE-2021-46758?
No fix has been published for CVE-2021-46758 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-46758 being exploited?
There is no known exploitation of CVE-2021-46758 in the wild and no public exploit code.
Sources
Also known as GHSA-qvg6-x224-c55m.