#VU63746 Security features bypass in AMD products - CVE-2021-26382
Published: May 26, 2022
Vulnerability identifier: #VU63746
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2021-26382
CWE-ID: CWE-254
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerable software:
AMD Ryzen 5000 Series Desktop processor with Radeon graphics
AMD Ryzen 3000 Series Mobile processor with Radeon graphics
AMD Ryzen 5000 Series Mobile processor with Radeon graphics
AMD Ryzen 5000 Series Desktop processor with Radeon graphics
AMD Ryzen 3000 Series Mobile processor with Radeon graphics
AMD Ryzen 5000 Series Mobile processor with Radeon graphics
Software vendor:
AMD
AMD
Description
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to missing verification of the signing key when processing ACP firmware images. A local privileged user can load any legitimately signed firmware image into the Audio
Co-Processor (ACP) irrespective of the respective signing key being
declared as usable for authenticating an ACP firmware image, and perform a denial of service (DoS) attack.
Remediation
Install updates from vendor's website.