CVE-2021-46765 Denial of service in Ryzen™ 3000 Series Mobile Processors with Radeon™ Graphics “Renoir”
An attacker with compromised SMM can trigger out-of-bounds memory reads in AMD ASP, causing a denial of service on affected Ryzen processors.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-46765?
CVE-2021-46765 is a high-severity denial of service vulnerability in AMD Ryzen™ 3000 Series Mobile Processors with Radeon™ Graphics “Renoir” , published on 9 May 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Insufficient input validation in ASP may allow an attacker with a compromised SMM to induce out-of-bounds memory reads within the ASP, potentially leading to a denial of service.
Weakness: CWE-125
Which versions are affected by CVE-2021-46765?
It affects 44 products.
Products include Amd Ryzen 3100 Firmware, Amd Ryzen 3300x Firmware, Amd Ryzen 3500 Firmware, Amd Ryzen 3500x Firmware, Amd Ryzen 3600 Firmware, Amd Ryzen 3600x Firmware and 38 more.
How do I fix CVE-2021-46765?
No fix has been published for CVE-2021-46765 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-46765 being exploited?
There is no known exploitation of CVE-2021-46765 in the wild and no public exploit code.
Other vulnerabilities in AMD Ryzen™ 3000 Series Mobile Processors with Radeon™ Graphics “Renoir”
Sources
Also known as GHSA-vfqw-535x-mpvj.