Improper Input Validation in AMD Trusted Execution Environment
CVE-2021-46759

6.1MEDIUM

Key Information:

Vendor

Amd
Status
Ryzen™ 2000 Series Desktop Processors “raven Ridge” Am4
Ryzen™ 5000 Series Desktop Processor With Radeon™ Graphics “cezanne” Am4
Athlon™ 3000 Series Mobile Processors With Radeon™ Graphics “dali”/”dali” Ulp
Athlon™ 3000 Series Mobile Processors With Radeon™ Graphics “pollock”
Vendor
CVE Published:
9 May 2023

What is CVE-2021-46759?

The vulnerability involves improper validation of syscall inputs in the AMD Trusted Execution Environment. This flaw could allow an attacker, possessing physical access, to exploit a User Application that operates beneath the bootloader. By doing so, the attacker could potentially expose sensitive information from the AMD Secure Processor's bootloader memory to an external serial port, posing a risk to the system's integrity.

Affected Version(s)

Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics “Pollock” x86 various

Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics “Dali”/”Dali” ULP x86 various

Ryzen™ 2000 series Desktop Processors “Raven Ridge” AM4 x86 various

References

https://www.amd.com/en/corporate/product-security/bulleti...
vendor-advisory

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Physical
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.