CVE-2021-46778 Information disclosure in AMD Processors

What is CVE-2021-46778?

CVE-2021-46778 is a medium-severity vulnerability in Amd Epyc 7232p Firmware, published on 9 Aug 2022. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Execution unit scheduler contention may lead to a side channel vulnerability found on AMD CPU microarchitectures codenamed “Zen 1”, “Zen 2” and “Zen 3” that use simultaneous multithreading (SMT). By measuring the contention level on scheduler queues an attacker may potentially leak sensitive information.

Weakness: CWE-203

Which versions are affected by CVE-2021-46778?

It affects 179 products.

Products include Amd Athlon 3050ge Firmware, Amd Athlon 3150g Firmware, Amd Athlon 3150ge Firmware, Amd Epyc 7001 Firmware, Amd Epyc 7002 Firmware, Amd Epyc 7003 Firmware and 173 more.

How do I fix CVE-2021-46778?

No fix has been published for CVE-2021-46778 yet. Limit exposure of the affected software until one is available.

Is CVE-2021-46778 being exploited?

There is no known exploitation of CVE-2021-46778 in the wild and no public exploit code.

Other vulnerabilities in Amd Epyc 7232p Firmware

• CVE-2021-26316 Memory corruption in 1st Gen EPYC High 7.8
• CVE-2021-26317 Security feature bypass in Athlon™ Series High 7.8
• CVE-2021-26369 Memory corruption in Athlon™ Series High 7.8
• CVE-2020-12965 Information disclosure in All supported processors High 7.5
• CVE-2021-26362 Privilege escalation in Athlon™ Series High 7.1

All Amd Epyc 7232p Firmware vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-745h-3gvr-9mc6.