Buffer overflow in AMD products - CVE-2021-26352

Vulnerability identifier: #VU63739

CSH Severity: Low

CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

CVE-ID: CVE-2021-26352

CWE-ID: CWE-119

Exploitation vector: Local access

Exploit availability: No public exploit available

Vendor: AMD

Affected software:
AMD Ryzen 2000 series Desktop processor
AMD Ryzen 3000 Series Desktop processor
AMD Ryzen 5000 Series Desktop processor
2nd Gen AMD Ryzen Threadripper processors
3rd Gen AMD Ryzen Threadripper processors
AMD Ryzen Threadripper PRO processors

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in System Management Unit (SMU) PCIe Hot Plug table. A local user can trigger memory corruption and perform a denial of service (DoS) attack.

Install updates from vendor's website.

• https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1027