CVE-2021-46758

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Insufficient validation of SPI flash addresses in the ASP (AMD Secure Processor) bootloader may allow an attacker to read data in memory mapped beyond SPI flash resulting in a potential loss of availability and integrity.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Affected software

Vendor	Product	Versions
AMD	Ryzen™ 5000 Series Desktop Processor with Radeon™ Graphics “Cezanne”	various
AMD	Ryzen™ 7000 Series Desktop Processors “Raphael” XD3	various
AMD	Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics “Renoir” FP6	various
AMD	Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics “Lucienne”	various
AMD	Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics “Cezanne”	various
AMD	AMD Ryzen™ 6000 Series Processors with Radeon™ Graphics "Rembrandt"	various
AMD	AMD Ryzen™ 7035 Series Processors with Radeon™ Graphics “Rembrandt-R”	various
AMD	AMD Ryzen™ 5000 Series Processors with Radeon™ Graphics “Barcelo”	various
AMD	AMD Ryzen™ 7030 Series Mobile Processors with Radeon™ Graphics “Barcelo-R”	various

References

https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-4002Vendor Advisory
https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-4002Vendor Advisory

Timeline

Published: Nov 14, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-467596.1Improper syscall input validation in AMD TEE (Trusted Execution Environment) may allow an attacker with physical access and control of a Uap CVE-2021-467609.8A malicious or compromised UApp or ABL can send a malformed system call to the bootloader, which may result in an out-of-bounds memory acces CVE-2021-467629.1Insufficient input validation in the SMU may allow an attacker to corrupt SMU SRAM potentially leading to a loss of integrity or denial of s CVE-2021-467637.5Insufficient input validation in the SMU may enable a privileged attacker to write beyond the intended bounds of a shared memory buffer pote CVE-2021-467647.5Improper validation of DRAM addresses in SMU may allow an attacker to overwrite sensitive memory locations within the ASP potentially result CVE-2021-467657.5Insufficient input validation in ASP may allow an attacker with a compromised SMM to induce out-of-bounds memory reads within the ASP, poten CVE-2021-467665.5Improper clearing of sensitive data in the ASP Bootloader may expose secret keys to a privileged attacker accessing ASP SRAM, potentially le CVE-2021-467676.1Insufficient input validation in the ASP may allow an attacker with physical access, unauthorized write access to memory potentially leading CVE-2021-467685.5Insufficient input validation in SEV firmware may allow an attacker to perform out-of-bounds memory reads within the ASP boot loader, potent CVE-2021-467698.8Insufficient syscall input validation in the ASP Bootloader may allow a privileged attacker to execute arbitrary DMA copies, which can lead CVE-2021-467717.8Insufficient validation of addresses in AMD Secure Processor (ASP) firmware system call may potentially lead to arbitrary code execution by CVE-2021-467723.9Insufficient input validation in the ABL may allow a privileged attacker with access to the BIOS menu or UEFI shell to tamper with the struc