CVE-2021-46766 : Improper clearing of sensitive data in the ASP Bootloader may expose secret keys

Improper clearing of sensitive data in the ASP Bootloader may expose secret keys to a privileged attacker accessing ASP SRAM, potentially leading to a loss of confidentiality.

Published 2023-11-14 19:15:10

Updated 2024-06-18 19:15:56

Source Advanced Micro Devices Inc.

View at NVD, CVE.org

Products affected by CVE-2021-46766

AMD » Ryzen Threadripper Pro 3995wx Firmware
Versions before (<) chagallwspi-swrx8_1.0.0.5
cpe:2.3:o:amd:ryzen_threadripper_pro_3995wx_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Ryzen Threadripper Pro 3995wx » Version: N/A
AMD » Ryzen Threadripper Pro 3975wx Firmware
Versions before (<) chagallwspi-swrx8_1.0.0.5
cpe:2.3:o:amd:ryzen_threadripper_pro_3975wx_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Ryzen Threadripper Pro 3975wx » Version: N/A
AMD » Ryzen Threadripper Pro 3955wx Firmware
Versions before (<) chagallwspi-swrx8_1.0.0.5
cpe:2.3:o:amd:ryzen_threadripper_pro_3955wx_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Ryzen Threadripper Pro 3955wx » Version: N/A
AMD » Ryzen Threadripper Pro 3945wx Firmware
Versions before (<) chagallwspi-swrx8_1.0.0.5
cpe:2.3:o:amd:ryzen_threadripper_pro_3945wx_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Ryzen Threadripper Pro 3945wx » Version: N/A
AMD » Epyc 9124 Firmware
Versions before (<) genoapi_1.0.0.4
cpe:2.3:o:amd:epyc_9124_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 9124 » Version: N/A
AMD » Epyc 9174f Firmware
Versions before (<) genoapi_1.0.0.4
cpe:2.3:o:amd:epyc_9174f_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 9174f » Version: N/A
AMD » Epyc 9184x Firmware
Versions before (<) genoapi_1.0.0.4
cpe:2.3:o:amd:epyc_9184x_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 9184x » Version: N/A
AMD » Epyc 9224 Firmware
Versions before (<) genoapi_1.0.0.4
cpe:2.3:o:amd:epyc_9224_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 9224 » Version: N/A
AMD » Epyc 9254 Firmware
Versions before (<) genoapi_1.0.0.4
cpe:2.3:o:amd:epyc_9254_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 9254 » Version: N/A
AMD » Epyc 9274f Firmware
Versions before (<) genoapi_1.0.0.4
cpe:2.3:o:amd:epyc_9274f_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 9274f » Version: N/A
AMD » Epyc 9334 Firmware
Versions before (<) genoapi_1.0.0.4
cpe:2.3:o:amd:epyc_9334_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 9334 » Version: N/A
AMD » Epyc 9354 Firmware
Versions before (<) genoapi_1.0.0.4
cpe:2.3:o:amd:epyc_9354_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 9354 » Version: N/A
AMD » Epyc 9354p Firmware
Versions before (<) genoapi_1.0.0.4
cpe:2.3:o:amd:epyc_9354p_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 9354p » Version: N/A
AMD » Epyc 9374f Firmware
Versions before (<) genoapi_1.0.0.4
cpe:2.3:o:amd:epyc_9374f_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 9374f » Version: N/A
AMD » Epyc 9384x Firmware
Versions before (<) genoapi_1.0.0.4
cpe:2.3:o:amd:epyc_9384x_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 9384x » Version: N/A
AMD » Epyc 9454 Firmware
Versions before (<) genoapi_1.0.0.4
cpe:2.3:o:amd:epyc_9454_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 9454 » Version: N/A
AMD » Epyc 9454p Firmware
Versions before (<) genoapi_1.0.0.4
cpe:2.3:o:amd:epyc_9454p_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 9454p » Version: N/A
AMD » Epyc 9474f Firmware
Versions before (<) genoapi_1.0.0.4
cpe:2.3:o:amd:epyc_9474f_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 9474f » Version: N/A
AMD » Epyc 9534 Firmware
Versions before (<) genoapi_1.0.0.4
cpe:2.3:o:amd:epyc_9534_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 9534 » Version: N/A
AMD » Epyc 9554p Firmware
Versions before (<) genoapi_1.0.0.4
cpe:2.3:o:amd:epyc_9554p_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 9554p » Version: N/A
AMD » Epyc 9554 Firmware
Versions before (<) genoapi_1.0.0.4
cpe:2.3:o:amd:epyc_9554_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 9554 » Version: N/A
AMD » Epyc 9634 Firmware
Versions before (<) genoapi_1.0.0.4
cpe:2.3:o:amd:epyc_9634_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 9634 » Version: N/A
AMD » Epyc 9654 Firmware
Versions before (<) genoapi_1.0.0.4
cpe:2.3:o:amd:epyc_9654_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 9654 » Version: N/A
AMD » Epyc 9654p Firmware
Versions before (<) genoapi_1.0.0.4
cpe:2.3:o:amd:epyc_9654p_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 9654p » Version: N/A
AMD » Epyc 9684x Firmware
Versions before (<) genoapi_1.0.0.4
cpe:2.3:o:amd:epyc_9684x_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 9684x » Version: N/A
AMD » Epyc 9734 Firmware
Versions before (<) genoapi_1.0.0.4
cpe:2.3:o:amd:epyc_9734_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 9734 » Version: N/A
AMD » Epyc 9754 Firmware
Versions before (<) genoapi_1.0.0.4
cpe:2.3:o:amd:epyc_9754_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 9754 » Version: N/A
AMD » Epyc 9754s Firmware
Versions before (<) genoapi_1.0.0.4
cpe:2.3:o:amd:epyc_9754s_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: AMD » Epyc 9754s » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2021-46766

EPSS FAQ

0.05%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 12 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2021-46766

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
5.5	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	1.8	3.6	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None
2.5	LOW	CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N	0.8	1.4	Advanced Micro Devices Inc.	2024-06-18
Attack Vector: Local Attack Complexity: High Privileges Required: High User Interaction: None Scope: Changed Confidentiality: Low Integrity: None Availability: None

CWE ids for CVE-2021-46766

CWE-459 Incomplete Cleanup

The product does not properly "clean up" and remove temporary or supporting resources after they have been used.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2021-46766

https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-3002

AMD Server Vulnerabilities – Nov 2023
Vendor Advisory

CVEs referencing this url
https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-4002

AMD Client Vulnerabilities – November 2023
Vendor Advisory

CVEs referencing this url
https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-5001

AMD Embedded Processors Vulnerabilities – February 2024

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2021-46766

Products affected by CVE-2021-46766

Exploit prediction scoring system (EPSS) score for CVE-2021-46766

CVSS scores for CVE-2021-46766

CWE ids for CVE-2021-46766

References for CVE-2021-46766