Security features bypass in AMD products - CVE-2021-26382
Published: May 26, 2022
Vulnerability identifier: #VU63746
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2021-26382
CWE-ID: CWE-254
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: AMD
Affected software:
AMD Ryzen 5000 Series Desktop processor with Radeon graphics
AMD Ryzen 3000 Series Mobile processor with Radeon graphics
AMD Ryzen 5000 Series Mobile processor with Radeon graphics
AMD Ryzen 5000 Series Desktop processor with Radeon graphics
AMD Ryzen 3000 Series Mobile processor with Radeon graphics
AMD Ryzen 5000 Series Mobile processor with Radeon graphics
Detailed vulnerability description
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to missing verification of the signing key when processing ACP firmware images. A local privileged user can load any legitimately signed firmware image into the Audio
Co-Processor (ACP) irrespective of the respective signing key being
declared as usable for authenticating an ACP firmware image, and perform a denial of service (DoS) attack.
How to mitigate CVE-2021-26382
Install updates from vendor's website.