CVE-2021-46758

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Insufficient validation of SPI flash addresses in the ASP (AMD Secure Processor) bootloader may allow an attacker to read data in memory mapped beyond SPI flash resulting in a potential loss of availability and integrity.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published
Nov 14, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-467596.1Improper syscall input validation in AMD TEE (Trusted Execution Environment) may allow an attacker with physical access and control of a UapCVE-2021-467609.8A malicious or compromised UApp or ABL can send a malformed system call to the bootloader, which may result in an out-of-bounds memory accesCVE-2021-467629.1Insufficient input validation in the SMU may allow an attacker to corrupt SMU SRAM potentially leading to a loss of integrity or denial of sCVE-2021-467637.5Insufficient input validation in the SMU may enable a privileged attacker to write beyond the intended bounds of a shared memory buffer poteCVE-2021-467647.5Improper validation of DRAM addresses in SMU may allow an attacker to overwrite sensitive memory locations within the ASP potentially resultCVE-2021-467657.5Insufficient input validation in ASP may allow an attacker with a compromised SMM to induce out-of-bounds memory reads within the ASP, potenCVE-2021-467665.5Improper clearing of sensitive data in the ASP Bootloader may expose secret keys to a privileged attacker accessing ASP SRAM, potentially leCVE-2021-467676.1Insufficient input validation in the ASP may allow an attacker with physical access, unauthorized write access to memory potentially leadingCVE-2021-467685.5Insufficient input validation in SEV firmware may allow an attacker to perform out-of-bounds memory reads within the ASP boot loader, potentCVE-2021-467698.8Insufficient syscall input validation in the ASP Bootloader may allow a privileged attacker to execute arbitrary DMA copies, which can lead CVE-2021-467717.8Insufficient validation of addresses in AMD Secure Processor (ASP) firmware system call may potentially lead to arbitrary code execution by CVE-2021-467723.9Insufficient input validation in the ABL may allow a privileged attacker with access to the BIOS menu or UEFI shell to tamper with the struc
CVE-2021-46758: Medium severity, CVSS 6.1 | Vulnix