CVE-2021-46754

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

Insufficient input validation in the ASP (AMD Secure Processor) bootloader may allow an attacker with a compromised Uapp or ABL to coerce the bootloader into exposing sensitive information to the SMU (System Management Unit) resulting in a potential loss of confidentiality and integrity.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published
May 9, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-467557.5Failure to unmap certain SysHub mappings in error paths of the ASP (AMD Secure Processor) bootloader may allow an attacker with a malicious CVE-2021-467569.1Insufficient validation of inputs in SVC_MAP_USER_STACK in the ASP (AMD Secure Processor) bootloader may allow an attacker with a malicious CVE-2021-467577.8Insufficient checking of memory buffer in ASP Secure OS may allow an attacker with a malicious TA to read/write to the ASP Secure OS kernel CVE-2021-467586.1Insufficient validation of SPI flash addresses in the ASP (AMD Secure Processor) bootloader may allow an attacker to read data in memory mapCVE-2021-467596.1Improper syscall input validation in AMD TEE (Trusted Execution Environment) may allow an attacker with physical access and control of a UapCVE-2021-467609.8A malicious or compromised UApp or ABL can send a malformed system call to the bootloader, which may result in an out-of-bounds memory accesCVE-2021-467629.1Insufficient input validation in the SMU may allow an attacker to corrupt SMU SRAM potentially leading to a loss of integrity or denial of sCVE-2021-467637.5Insufficient input validation in the SMU may enable a privileged attacker to write beyond the intended bounds of a shared memory buffer poteCVE-2021-467647.5Improper validation of DRAM addresses in SMU may allow an attacker to overwrite sensitive memory locations within the ASP potentially resultCVE-2021-467657.5Insufficient input validation in ASP may allow an attacker with a compromised SMM to induce out-of-bounds memory reads within the ASP, potenCVE-2021-467665.5Improper clearing of sensitive data in the ASP Bootloader may expose secret keys to a privileged attacker accessing ASP SRAM, potentially leCVE-2021-467676.1Insufficient input validation in the ASP may allow an attacker with physical access, unauthorized write access to memory potentially leading
CVE-2021-46754: Critical severity, CVSS 9.1 | Vulnix