CVE-2021-26334

CriticalCVSS 9.9/10Last modified Jun 17, 2026

Description

The AMDPowerProfiler.sys driver of AMD μProf tool may allow lower privileged users to access MSRs in kernel which may lead to privilege escalation and ring-0 code execution by the lower privileged user.

Metrics

CVSS 3.1 9.9/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-284

Affected software

Vendor	Product	Versions
AMD	μProf Tool	>= μProf Tool, < 3.4.494

References

https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1016Mitigation, Vendor Advisory
https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1016Mitigation, Vendor Advisory

Timeline

Published: Dec 1, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-263357.8Improper input and range checking in the AMD Secure Processor (ASP) boot loader image header may allow an attacker to use attacker-controlle CVE-2021-263365.5Insufficient bounds checking in System Management Unit (SMU) may cause invalid memory accesses/updates that could result in SMU hang and sub CVE-2021-263375.5Insufficient DRAM address validation in System Management Unit (SMU) may result in a DMA read from invalid DRAM address to SRAM resulting in CVE-2021-263387.5Improper access controls in System Management Unit (SMU) may allow for an attacker to override performance control tables located in DRAM re CVE-2021-263395.5A bug in AMD CPU’s core logic may allow for an attacker, using specific code from an unprivileged VM, to trigger a CPU core hang resulting i CVE-2021-263408.4A malicious hypervisor in conjunction with an unprivileged attacker process inside an SEV/SEV-ES guest VM may fail to flush the Translation CVE-2021-263416.5Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage.CVE-2021-263423.3In SEV guest VMs, the CPU may fail to flush the Translation Lookaside Buffer (TLB) following a particular sequence of operations that includ CVE-2021-263435.5Insufficient validation in ASP BIOS and DRTM commands may allow malicious supervisor x86 software to disclose the contents of sensitive memo CVE-2021-263448.2An out of bounds memory write when processing the AMD PSP1 Configuration Block (APCB) could allow an attacker with access the ability to mod CVE-2021-263454.9Failure to validate the value in APCB may allow a privileged attacker to tamper with the APCB token to force an out-of-bounds memory read po CVE-2021-263465.5Failure to validate the integer operand in ASP (AMD Secure Processor) bootloader may allow an attacker to introduce an integer overflow in t