CVE-2021-46772

LowCVSS 3.9/10Last modified Jun 17, 2026

Description

Insufficient input validation in the ABL may allow a privileged attacker with access to the BIOS menu or UEFI shell to tamper with the structure headers in SPI ROM causing an out of bounds memory read and write, potentially resulting in memory corruption or denial of service.

Metrics

CVSS 3.1 3.9/10CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:L

Weakness enumeration

CWE-125 CWE-787

Affected software

No affected versions have been published.

Timeline

Published: Aug 13, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2021

CVE-2021-467738.8Insufficient input validation in ABL may enable a privileged attacker to corrupt ASP memory, potentially resulting in a loss of integrity or CVE-2021-467747.5Insufficient DRAM address validation in System Management Unit (SMU) may allow an attacker to read/write from/to an invalid DRAM address, po CVE-2021-467756.8Improper input validation in ABL may enable an attacker with physical access, to perform arbitrary memory overwrites, potentially leading to CVE-2021-467785.6Execution unit scheduler contention may lead to a side channel vulnerability found on AMD CPU microarchitectures codenamed “Zen 1”, “Zen 2” CVE-2021-467797.1Insufficient input validation in SVC_ECC_PRIMITIVE system call in a compromised user application or ABL may allow an attacker to corrupt ASP CVE-2021-467806.1The Easy Google Maps WordPress plugin before 1.9.32 does not escape the tab parameter before outputting it back in an attribute in the admin CVE-2021-467816.1The Coming Soon by Supsystic WordPress plugin before 1.7.6 does not sanitise and escape the tab parameter before outputting it back in an at CVE-2021-467826.1The Pricing Table by Supsystic WordPress plugin before 1.9.5 does not escape the tab parameter before outputting it back in an attribute in CVE-2021-467846.5In Squid 3.x through 3.5.28, 4.x through 4.17, and 5.x before 5.6, due to improper buffer management, a Denial of Service can occur when pro CVE-2021-467855.3The Property module has a vulnerability in permission control.This vulnerability can be exploited to obtain the unique device identifier.CVE-2021-467869.8The audio module has a vulnerability in verifying the parameters passed by the application space.Successful exploitation of this vulnerabili CVE-2021-467877.5The AMS module has a vulnerability of improper permission control.Successful exploitation of this vulnerability may cause non-system applica