CVE-2021-26378

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

Insufficient bound checks in the System Management Unit (SMU) may result in access to an invalid address space that could result in denial of service.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-119

Affected software

No affected versions have been published.

Timeline

Published: May 11, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-263799.8Insufficient input validation of mailbox data in the SMU may allow an attacker to coerce the SMU to corrupt SMRAM, potentially leading to a CVE-2021-263801.8A compromised Trusted OS (TOS) driver could issue a malformed call that could potentially allow memory access outside the intended range re CVE-2021-263817.1Improper system call parameter validation in the Trusted OS may allow a malicious driver to perform mapping or unmapping operations on a lar CVE-2021-263824.4An attacker with root account privileges can load any legitimately signed firmware image into the Audio Co-Processor (ACP,) irrespective of CVE-2021-263837.9Insufficient bounds checking in AMD TEE (Trusted Execution Environment) could allow an attacker with a compromised userspace to invoke a com CVE-2021-263847.8A malformed SMI (System Management Interface) command may allow an attacker to establish a corrupted SMI Trigger Info data structure, potent CVE-2021-263867.8A malicious or compromised UApp or ABL may be used by an attacker to issue a malformed system call to the Stage 2 Bootloader potentially lea CVE-2021-263873.9Insufficient access controls in ASP kernel may allow a privileged attacker with access to AMD signing keys and the BIOS menu or UEFI shell t CVE-2021-263885.5Improper validation of the BIOS directory may allow for searches to read beyond the directory table copy in RAM, exposing out of bounds memo CVE-2021-263906.2A malicious or compromised UApp or ABL may coerce the bootloader into corrupting arbitrary memory potentially leading to loss of integrity o CVE-2021-263917.8Insufficient verification of multiple header signatures while loading a Trusted Application (TA) may allow an attacker with privileges to ga CVE-2021-263927.8Insufficient verification of missing size check in 'LoadModule' may lead to an out-of-bounds write potentially allowing an attacker with pri