CVE-2021-46792

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

Time-of-check Time-of-use (TOCTOU) in the BIOS2PSP command may allow an attacker with a malicious BIOS to create a race condition causing the ASP bootloader to perform out-of-bounds SRAM reads upon an S3 resume event potentially leading to a denial of service.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-367

Affected software

Vendor	Product	Versions
AMD	Ryzen™ 2000 series Desktop Processors “Raven Ridge” AM4	various
AMD	Ryzen™ 5000 Series Desktop processor with Radeon™ Graphics “Cezanne” AM4	Various
AMD	Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics “Dali”/”Dali” ULP	various
AMD	Ryzen™ 2000 Series Mobile Processors “Raven Ridge” FP5	various
AMD	Ryzen™ 3000 Series Mobile processor, 2nd Gen AMD Ryzen™ Mobile Processors with Radeon™ Graphics “Picasso”	various
AMD	Ryzen™ 3000 Series Mobile Processors with Radeon™ Graphics “Renoir”	various
AMD	Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics “Lucienne”	various
AMD	Ryzen™ 5000 Series Mobile processors with Radeon™ Graphics “Cezanne”	various

References

https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-4001Vendor Advisory
https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-4001Vendor Advisory

Timeline

Published: May 9, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-467947.5Insufficient bounds checking in ASP (AMD Secure Processor) may allow for an out of bounds read in SMI (System Management Interface) mailbox CVE-2021-467954.7A TOCTOU (time-of-check to time-of-use) vulnerability exists where an attacker may use a compromised BIOS to cause the TEE OS to read memory CVE-2021-468115.3HwSEServiceAPP has a vulnerability in permission management. Successful exploitation of this vulnerability may cause disclosure of the Card CVE-2021-468127.5The Device Manager has a vulnerability in multi-device interaction. Successful exploitation of this vulnerability may affect data integrity.CVE-2021-468137.5Vulnerability of residual files not being deleted after an update in the ChinaDRM module. Successful exploitation of this vulnerability may CVE-2021-468147.5The video framework has an out-of-bounds memory read/write vulnerability. Successful exploitation of this vulnerability may affect system av CVE-2021-468167.8Adobe Premiere Pro version 15.4 (and earlier) are affected by a memory corruption vulnerability. An unauthenticated attacker could leverage CVE-2021-468177.8Adobe Media Encoder version 15.4 (and earlier) are affected by a memory corruption vulnerability. An unauthenticated attacker could leverage CVE-2021-468187.8Adobe Media Encoder version 15.4 (and earlier) are affected by a memory corruption vulnerability. An unauthenticated attacker could leverage CVE-2021-468208.1Arbitrary File Deletion vulnerability in XOS-Shop xos_shop_system 1.0.9 via current_manufacturer_image parameter to /shop/admin/categories.p CVE-2021-468225.5The PPM reader in libjpeg-turbo through 2.0.90 mishandles use of tjLoadImage for loading a 16-bit binary PPM file into a grayscale buffer an CVE-2021-468236.5python-ldap before 3.4.0 is vulnerable to a denial of service when ldap.schema is used for untrusted schema definitions, because of a regula