#VU61565 Exposure of Resource to Wrong Sphere in AMD products - CVE-2021-26341

Vulnerability identifier: #VU61565

Vulnerability risk: Low

CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

CVE-ID: CVE-2021-26341

CWE-ID: CWE-668

Exploitation vector: Local access

Exploit availability: No public exploit available

Vulnerable software:
AMD Athlon X4 processor
AMD Ryzen Threadripper PRO processors
2nd Gen AMD Ryzen Threadripper processors
3rd Gen AMD Ryzen Threadripper processors
7th Generation AMD A-Series APUs
AMD Ryzen 2000 Series Desktop processors
AMD Ryzen 3000 Series Desktop processors
AMD Ryzen 4000 Series Desktop processors with Radeon graphics
AMD Ryzen 2000 Series Mobile processor
AMD Athlon 3000 Series Mobile processors with Radeon Graphics
AMD Ryzen 3000 Series Mobile processors or 2nd Gen AMD Ryzen Mobile processors with Radeon graphics
AMD Ryzen 4000 Series Mobile processors with Radeon graphics
AMD Ryzen 5000 Series Mobile processors with Radeon graphics
AMD Athlon Mobile processors with Radeon graphics
1st Gen AMD EPYC Processors
2nd Gen AMD EPYC Processors

Software vendor:
AMD

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to some AMD CPUs may transiently execute beyond unconditional direct branches. A local user can gain unauthorized access to sensitive information on the system.

Install updates from vendor's website.

• https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1026
• http://www.openwall.com/lists/oss-security/2022/03/18/2