Input validation error in AMD products - CVE-2021-26351
Published: May 26, 2022
Vulnerability identifier: #VU63740
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2021-26351
CWE-ID: CWE-20
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: AMD
Affected software:
AMD Ryzen 3000 Series Desktop processor
AMD Ryzen 5000 Series Desktop processor
3rd Gen AMD Ryzen Threadripper processors
AMD Ryzen Threadripper PRO processors
AMD Ryzen 3000 Series Desktop processor
AMD Ryzen 5000 Series Desktop processor
3rd Gen AMD Ryzen Threadripper processors
AMD Ryzen Threadripper PRO processors
Detailed vulnerability description
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient DRAM address validation in System Management Unit (SMU). A local user can force DMA (Direct Memory Access) to read or write from/to invalid DRAM address and perform a denial of service (DoS) attack.
How to mitigate CVE-2021-26351
Install updates from vendor's website.