CVE-2021-46792 Race condition in Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics “Dali”/”Dali” ULP

What is CVE-2021-46792?

CVE-2021-46792 is a medium-severity vulnerability in AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics “Dali”/”Dali” ULP, published on 9 May 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Time-of-check Time-of-use (TOCTOU) in the BIOS2PSP command may allow an attacker with a malicious BIOS to create a race condition causing the ASP bootloader to perform out-of-bounds SRAM reads upon an S3 resume event potentially leading to a denial of service.

Weakness: CWE-367

Which versions are affected by CVE-2021-46792?

It affects 55 products.

Products include Amd Athlon Gold 3150g Firmware, Amd Athlon Gold 3150ge Firmware, Amd Athlon Silver 3050ge Firmware, Amd Ryzen 1200 \(Af\) Firmware, Amd Ryzen 1600 \(Af\) Firmware, Amd Ryzen 2200g Firmware and 49 more.

How do I fix CVE-2021-46792?

No fix has been published for CVE-2021-46792 yet. Limit exposure of the affected software until one is available.

Is CVE-2021-46792 being exploited?

There is no known exploitation of CVE-2021-46792 in the wild and no public exploit code.

Other vulnerabilities in AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics “Dali”/”Dali” ULP

• CVE-2021-46753 Memory corruption in Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics “Pollock” Critical 9.1
• CVE-2021-46754 Information disclosure in AMD Ryzen™ Embedded R1000 Critical 9.1
• CVE-2022-23815 Memory corruption in AMD Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics High 7.5
• CVE-2021-46749 Denial of service in 3rd Gen AMD Ryzen™ Threadripper™ Processors “Castle Peak” HEDT High 7.5
• CVE-2021-46794 Denial of service in 3rd Gen AMD Ryzen™ Threadripper™ Processors “Castle Peak” HEDT High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-38q7-2qqc-fvvr.