CVE-2021-46771 Other in 3rd Gen AMD EPYC™
A compromised user application can exploit insufficient address validation in AMD Secure Processor firmware to achieve arbitrary code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-46771?
CVE-2021-46771 is a high-severity vulnerability in Amd Epyc 72f3 Firmware, published on 10 May 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Insufficient validation of addresses in AMD Secure Processor (ASP) firmware system call may potentially lead to arbitrary code execution by a compromised user application.
Weakness: CWE-20
Which versions are affected by CVE-2021-46771?
It affects 23 products.
Products include Amd Epyc 72f3 Firmware, Amd Epyc 7313 Firmware, Amd Epyc 7313p Firmware, Amd Epyc 7343 Firmware, Amd Epyc 7373x Firmware, Amd Epyc 73f3 Firmware and 17 more.
How do I fix CVE-2021-46771?
No fix has been published for CVE-2021-46771 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-46771 being exploited?
There is no known exploitation of CVE-2021-46771 in the wild and no public exploit code.
Other vulnerabilities in Amd Epyc 72f3 Firmware
Sources
Also known as GHSA-qfcc-w88q-7m85.