CVE-2021-46772: amd amd athlon™ 3000 series desktop processors with radeon™ graphics Out-of-bounds Read

Vulnerability summary

CVE-2021-46772 is a low (CVSS 3.9) Out-of-bounds Read vulnerability in amd amd athlon™ 3000 series desktop processors with radeon™ graphics. EPSS estimates a 0.18% chance of exploitation in the next 30 days, higher than 7.2% of scored vulnerabilities.

Timeline

1. 13-08-2024
   PublishedVulnerability first disclosed.
2. 05-11-2024
   Last modifiedVulnerability information updated.

Description

Insufficient input validation in the ABL may allow a privileged attacker with access to the BIOS menu or UEFI shell to tamper with the structure headers in SPI ROM causing an out of bounds memory read and write, potentially resulting in memory corruption or denial of service.

• CWE-125Out-of-bounds ReadThe product reads data past the end, or before the beginning, of the intended buffer.
• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.