#VU61566 Information disclosure in AMD products - CVE-2021-26401

Vulnerability identifier: #VU61566

Vulnerability risk: Low

CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

CVE-ID: CVE-2021-26401

CWE-ID: CWE-200

Exploitation vector: Local access

Exploit availability: No public exploit available

Vulnerable software:
1st Gen AMD EPYC Processors
2nd Gen AMD EPYC Processors
3rd Gen AMD EPYC Processors
AMD Ryzen 2000 series Desktop processor
AMD Ryzen 3000 Series Desktop processor
AMD Ryzen 5000 Series Desktop processor
AMD Ryzen 4000 Series Desktop processors with Radeon graphics
AMD Ryzen 5000 Series Desktop processor with Radeon graphics
2nd Gen AMD Ryzen Threadripper processors
3rd Gen AMD Ryzen Threadripper processors
AMD Ryzen Threadripper PRO processors
AMD Athlon 3000 Series Mobile processors with Radeon Graphics
AMD Ryzen 2000 Series Mobile processor
AMD Ryzen 3000 Series Mobile processor
2nd Gen AMD Ryzen Mobile processor with Radeon graphics
AMD Ryzen 3000 Series Mobile processor with Radeon graphics
AMD Ryzen 4000 Series Mobile processors with Radeon graphics
AMD Ryzen 5000 Series Mobile processor with Radeon graphics
AMD Athlon 3000 Series Mobile processor with Radeon graphics
AMD Athlon Mobile processor with Radeon graphics

Software vendor:
AMD

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application within LFENCE/JMP. A local user can gain unauthorized access to sensitive information on the system.

Install updates from vendor's website.

• https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1036
• http://www.openwall.com/lists/oss-security/2022/03/18/2