CVE-2021-46753 (GCVE-0-2021-46753)

Vulnerability from cvelistv5 – Published: 2023-05-09 19:00 – Updated: 2025-01-28 15:41
VLAI?
Summary
Failure to validate the length fields of the ASP (AMD Secure Processor) sensor fusion hub headers may allow an attacker with a malicious Uapp or ABL to map the ASP sensor fusion hub region and overwrite data structures leading to a potential loss of confidentiality and integrity.
Severity ?
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE
Assigner
AMD
References
Impacted products
Vendor Product Version
AMD Ryzen™ 2000 series Desktop Processors “Raven Ridge” AM4 Affected: various
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:17:41.736Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-4001"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 9.1,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2021-46753",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-28T15:41:03.256357Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-01-28T15:41:07.173Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "AGESA",
          "platforms": [
            "x86"
          ],
          "product": "Ryzen\u2122 2000 series Desktop Processors \u201cRaven Ridge\u201d AM4",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various "
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "AGESA",
          "platforms": [
            "x86"
          ],
          "product": "Ryzen\u2122 5000 Series Desktop processor with Radeon\u2122 Graphics  \u201cCezanne\u201d AM4",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various "
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "AGESA",
          "platforms": [
            "x86"
          ],
          "product": "Athlon\u2122 3000 Series Mobile Processors with Radeon\u2122 Graphics \u201cDali\u201d/\u201dDali\u201d ULP",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various "
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "AGESA",
          "platforms": [
            "x86"
          ],
          "product": "Athlon\u2122 3000 Series Mobile Processors with Radeon\u2122 Graphics   \u201cPollock\u201d",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various "
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "AGESA",
          "platforms": [
            "x86"
          ],
          "product": "Ryzen\u2122 2000 Series Mobile Processors \u201cRaven Ridge\u201d FP5",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various "
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "AGESA",
          "platforms": [
            "x86"
          ],
          "product": "Ryzen\u2122 3000 Series Mobile processor, 2nd Gen AMD Ryzen\u2122 Mobile Processors with Radeon\u2122 Graphics \u201cPicasso\u201d",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various "
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "AGESA",
          "platforms": [
            "x86"
          ],
          "product": "Ryzen\u2122 3000 Series Mobile Processors with Radeon\u2122 Graphics \u201cRenoir\u201d ",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various "
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "AGESA",
          "platforms": [
            "x86"
          ],
          "product": "Ryzen\u2122 5000 Series Mobile Processors with Radeon\u2122 Graphics \u201cLucienne\u201d",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various "
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "AGESA",
          "platforms": [
            "x86"
          ],
          "product": "Ryzen\u2122 5000 Series Mobile processors with Radeon\u2122 Graphics \u201cCezanne\u201d",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various "
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "AGESA",
          "platforms": [
            "x86"
          ],
          "product": "Ryzen\u2122 6000 Series Mobile Processors  \"Rembrandt\"",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "various "
            }
          ]
        }
      ],
      "datePublic": "2023-05-09T16:30:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Failure to validate the length fields of the ASP\n(AMD Secure Processor) sensor fusion hub headers may allow an attacker with a\nmalicious Uapp or ABL to map the ASP sensor fusion hub region and overwrite\ndata structures leading to a potential loss of confidentiality and integrity.\n\n\n\n\u003cbr\u003e"
            }
          ],
          "value": "Failure to validate the length fields of the ASP\n(AMD Secure Processor) sensor fusion hub headers may allow an attacker with a\nmalicious Uapp or ABL to map the ASP sensor fusion hub region and overwrite\ndata structures leading to a potential loss of confidentiality and integrity.\n\n\n\n\n"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-05-09T19:00:04.895Z",
        "orgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
        "shortName": "AMD"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-4001"
        }
      ],
      "source": {
        "advisory": "AMD-SB-4001",
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
    "assignerShortName": "AMD",
    "cveId": "CVE-2021-46753",
    "datePublished": "2023-05-09T19:00:04.895Z",
    "dateReserved": "2022-03-31T16:50:27.867Z",
    "dateUpdated": "2025-01-28T15:41:07.173Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-4001\", \"tags\": [\"vendor-advisory\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-04T05:17:41.736Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 9.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-46753\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-01-28T15:41:03.256357Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"description\": \"CWE-noinfo Not enough information\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-01-28T15:40:45.176Z\"}}], \"cna\": {\"source\": {\"advisory\": \"AMD-SB-4001\", \"discovery\": \"UNKNOWN\"}, \"affected\": [{\"vendor\": \"AMD\", \"product\": \"Ryzen\\u2122 2000 series Desktop Processors \\u201cRaven Ridge\\u201d AM4\", \"versions\": [{\"status\": \"affected\", \"version\": \"various \"}], \"platforms\": [\"x86\"], \"packageName\": \"AGESA\", \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"AMD\", \"product\": \"Ryzen\\u2122 5000 Series Desktop processor with Radeon\\u2122 Graphics  \\u201cCezanne\\u201d AM4\", \"versions\": [{\"status\": \"affected\", \"version\": \"various \"}], \"platforms\": [\"x86\"], \"packageName\": \"AGESA\", \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"AMD\", \"product\": \"Athlon\\u2122 3000 Series Mobile Processors with Radeon\\u2122 Graphics \\u201cDali\\u201d/\\u201dDali\\u201d ULP\", \"versions\": [{\"status\": \"affected\", \"version\": \"various \"}], \"platforms\": [\"x86\"], \"packageName\": \"AGESA\", \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"AMD\", \"product\": \"Athlon\\u2122 3000 Series Mobile Processors with Radeon\\u2122 Graphics   \\u201cPollock\\u201d\", \"versions\": [{\"status\": \"affected\", \"version\": \"various \"}], \"platforms\": [\"x86\"], \"packageName\": \"AGESA\", \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"AMD\", \"product\": \"Ryzen\\u2122 2000 Series Mobile Processors \\u201cRaven Ridge\\u201d FP5\", \"versions\": [{\"status\": \"affected\", \"version\": \"various \"}], \"platforms\": [\"x86\"], \"packageName\": \"AGESA\", \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"AMD\", \"product\": \"Ryzen\\u2122 3000 Series Mobile processor, 2nd Gen AMD Ryzen\\u2122 Mobile Processors with Radeon\\u2122 Graphics \\u201cPicasso\\u201d\", \"versions\": [{\"status\": \"affected\", \"version\": \"various \"}], \"platforms\": [\"x86\"], \"packageName\": \"AGESA\", \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"AMD\", \"product\": \"Ryzen\\u2122 3000 Series Mobile Processors with Radeon\\u2122 Graphics \\u201cRenoir\\u201d \", \"versions\": [{\"status\": \"affected\", \"version\": \"various \"}], \"platforms\": [\"x86\"], \"packageName\": \"AGESA\", \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"AMD\", \"product\": \"Ryzen\\u2122 5000 Series Mobile Processors with Radeon\\u2122 Graphics \\u201cLucienne\\u201d\", \"versions\": [{\"status\": \"affected\", \"version\": \"various \"}], \"platforms\": [\"x86\"], \"packageName\": \"AGESA\", \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"AMD\", \"product\": \"Ryzen\\u2122 5000 Series Mobile processors with Radeon\\u2122 Graphics \\u201cCezanne\\u201d\", \"versions\": [{\"status\": \"affected\", \"version\": \"various \"}], \"platforms\": [\"x86\"], \"packageName\": \"AGESA\", \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"AMD\", \"product\": \"Ryzen\\u2122 6000 Series Mobile Processors  \\\"Rembrandt\\\"\", \"versions\": [{\"status\": \"affected\", \"version\": \"various \"}], \"platforms\": [\"x86\"], \"packageName\": \"AGESA\", \"defaultStatus\": \"unaffected\"}], \"datePublic\": \"2023-05-09T16:30:00.000Z\", \"references\": [{\"url\": \"https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-4001\", \"tags\": [\"vendor-advisory\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.1.0-dev\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Failure to validate the length fields of the ASP\\n(AMD Secure Processor) sensor fusion hub headers may allow an attacker with a\\nmalicious Uapp or ABL to map the ASP sensor fusion hub region and overwrite\\ndata structures leading to a potential loss of confidentiality and integrity.\\n\\n\\n\\n\\n\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Failure to validate the length fields of the ASP\\n(AMD Secure Processor) sensor fusion hub headers may allow an attacker with a\\nmalicious Uapp or ABL to map the ASP sensor fusion hub region and overwrite\\ndata structures leading to a potential loss of confidentiality and integrity.\\n\\n\\n\\n\u003cbr\u003e\", \"base64\": false}]}], \"providerMetadata\": {\"orgId\": \"b58fc414-a1e4-4f92-9d70-1add41838648\", \"shortName\": \"AMD\", \"dateUpdated\": \"2023-05-09T19:00:04.895Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2021-46753\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-01-28T15:41:07.173Z\", \"dateReserved\": \"2022-03-31T16:50:27.867Z\", \"assignerOrgId\": \"b58fc414-a1e4-4f92-9d70-1add41838648\", \"datePublished\": \"2023-05-09T19:00:04.895Z\", \"assignerShortName\": \"AMD\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.