CVE-2021-46763

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Insufficient input validation in the SMU may enable a privileged attacker to write beyond the intended bounds of a shared memory buffer potentially leading to a loss of integrity.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
AMD	2nd Gen AMD EPYC™	various
AMD	3rd Gen AMD EPYC™	various

References

https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-3001Vendor Advisory
https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-3001Vendor Advisory

Timeline

Published: May 9, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-467647.5Improper validation of DRAM addresses in SMU may allow an attacker to overwrite sensitive memory locations within the ASP potentially result CVE-2021-467657.5Insufficient input validation in ASP may allow an attacker with a compromised SMM to induce out-of-bounds memory reads within the ASP, poten CVE-2021-467665.5Improper clearing of sensitive data in the ASP Bootloader may expose secret keys to a privileged attacker accessing ASP SRAM, potentially le CVE-2021-467676.1Insufficient input validation in the ASP may allow an attacker with physical access, unauthorized write access to memory potentially leading CVE-2021-467685.5Insufficient input validation in SEV firmware may allow an attacker to perform out-of-bounds memory reads within the ASP boot loader, potent CVE-2021-467698.8Insufficient syscall input validation in the ASP Bootloader may allow a privileged attacker to execute arbitrary DMA copies, which can lead CVE-2021-467717.8Insufficient validation of addresses in AMD Secure Processor (ASP) firmware system call may potentially lead to arbitrary code execution by CVE-2021-467723.9Insufficient input validation in the ABL may allow a privileged attacker with access to the BIOS menu or UEFI shell to tamper with the struc CVE-2021-467738.8Insufficient input validation in ABL may enable a privileged attacker to corrupt ASP memory, potentially resulting in a loss of integrity or CVE-2021-467747.5Insufficient DRAM address validation in System Management Unit (SMU) may allow an attacker to read/write from/to an invalid DRAM address, po CVE-2021-467756.8Improper input validation in ABL may enable an attacker with physical access, to perform arbitrary memory overwrites, potentially leading to CVE-2021-467785.6Execution unit scheduler contention may lead to a side channel vulnerability found on AMD CPU microarchitectures codenamed “Zen 1”, “Zen 2”