Permissions, Privileges, and Access Controls in AMD products - CVE-2021-26367

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU96630

Permissions, Privileges, and Access Controls in AMD products - CVE-2021-26367

Published: August 30, 2024


Vulnerability identifier: #VU96630
CSH Severity: Low
CVSS v4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-26367
CWE-ID: CWE-264
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to improper access restrictions. A local user can misconfigure the Trusted Memory Regions (TMRs) and set an arbitrary address range for the TMR, leading to privilege escalation.


Affected software

AMD Radeon Instinct MI50
AMD Instinct MI100
AMD Radeon Instinct MI25
AMD Radeon PRO V520
AMD Radeon PRO V620
Radeon RX 6000 Series
Radeon PRO W6000 Series

How to mitigate CVE-2021-26367

Install updates from vendor's website.

Radeon RX 6000 Series - update to 23.12.1
Radeon PRO W6000 Series - update to 23.30.13.03

External References