Back

CVE-2021-46772

Aug. 13, 2024, 5:15 p.m.

Received
CVE has been recently published to the CVE List and has been received by the NVD.

Products

AMD BIOS/UEFI Firmware

Source

psirt@amd.com

Tags

psirt@amd.com
2024-08-13
CVE-2021-46772

CVE-2021-46772 details

Published : Aug. 13, 2024, 5:15 p.m.
Last Modified : Aug. 13, 2024, 5:15 p.m.

Description

Insufficient input validation in the ABL may allow a privileged attacker with access to the BIOS menu or UEFI shell to tamper with the structure headers in SPI ROM causing an out of bounds memory read and write, potentially resulting in memory corruption or denial of service.

CVSS Score

1 2 3.9 4 5 6 7 8 9 10

Weakness

Weakness Name Description

CVSS Data

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

HIGH

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

Base Score

3.9

Exploitability Score

0.8

Impact Score

2.7

Base Severity

LOW

Vector String : CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:L

References

URL Source
https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3003.html psirt@amd.com
https://www.amd.com/en/resources/product-security/bulletin/amd-sb-4004.html psirt@amd.com
https://www.amd.com/en/resources/product-security/bulletin/amd-sb-5002.html psirt@amd.com
This website uses the NVD API, but is not approved or certified by it.