AMD Ryzen™ 2000 series Desktop Processors “Raven Ridge” AM4

CVE-2021-46756

CRITICAL 9.1

At a glance

Source: NVD
EPSS: EPSS 0.65 % · percentile 51 (2026-10-29)
State: PUBLISHED
Published: 2023-05-09 19:00 UTC
Updated: 2025-01-28 15:38 UTC
Assigner: AMD
NVD status: Modified

Search on…

Description

Insufficient validation of inputs in SVC_MAP_USER_STACK in the ASP (AMD Secure Processor) bootloader may allow an attacker with a malicious Uapp or ABL to send malformed or invalid syscall to the bootloader resulting in a potential denial of service and loss of integrity.

Weaknesses (CWE)

CWE-20 — Improper Input Validation

References

Scores

Version	Score	Vector	Scored by
CVSS 3.1	CRITICAL 9.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H	CISA-ADP
CVSS 3.1	CRITICAL 9.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H	NVD · nvd@nist.gov (Primary)
CVSS 3.1	CRITICAL 9.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H	NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

European references

ENISA EUVD · EUVD-2021-33412
GCVE · GCVE-0-2021-46756

Affected configurations (NVD CPE)

cpe:2.3:o:amd:epyc_72f3_firmware:milanpi_1.0.0.9:*:*:*:*:*:*:*
cpe:2.3:o:amd:epyc_7313_firmware:milanpi_1.0.0.9:*:*:*:*:*:*:*
cpe:2.3:o:amd:epyc_7313p_firmware:milanpi_1.0.0.9:*:*:*:*:*:*:*
cpe:2.3:o:amd:epyc_7343_firmware:milanpi_1.0.0.9:*:*:*:*:*:*:*
cpe:2.3:o:amd:epyc_7373x_firmware:milanpi_1.0.0.9:*:*:*:*:*:*:*
cpe:2.3:o:amd:epyc_73f3_firmware:milanpi_1.0.0.9:*:*:*:*:*:*:*
cpe:2.3:o:amd:epyc_7413_firmware:milanpi_1.0.0.9:*:*:*:*:*:*:*
cpe:2.3:o:amd:epyc_7443_firmware:milanpi_1.0.0.9:*:*:*:*:*:*:*
cpe:2.3:o:amd:epyc_7443p_firmware:milanpi_1.0.0.9:*:*:*:*:*:*:*
cpe:2.3:o:amd:epyc_7453_firmware:milanpi_1.0.0.9:*:*:*:*:*:*:*
cpe:2.3:o:amd:epyc_7473x_firmware:milanpi_1.0.0.9:*:*:*:*:*:*:*
cpe:2.3:o:amd:epyc_74f3_firmware:milanpi_1.0.0.9:*:*:*:*:*:*:*
cpe:2.3:o:amd:epyc_7513_firmware:milanpi_1.0.0.9:*:*:*:*:*:*:*
cpe:2.3:o:amd:epyc_7543_firmware:milanpi_1.0.0.9:*:*:*:*:*:*:*
cpe:2.3:o:amd:epyc_7543p_firmware:milanpi_1.0.0.9:*:*:*:*:*:*:*
cpe:2.3:o:amd:epyc_7573x_firmware:milanpi_1.0.0.9:*:*:*:*:*:*:*
cpe:2.3:o:amd:epyc_75f3_firmware:milanpi_1.0.0.9:*:*:*:*:*:*:*
cpe:2.3:o:amd:epyc_7643_firmware:milanpi_1.0.0.9:*:*:*:*:*:*:*
cpe:2.3:o:amd:epyc_7663_firmware:milanpi_1.0.0.9:*:*:*:*:*:*:*
cpe:2.3:o:amd:epyc_7713_firmware:milanpi_1.0.0.9:*:*:*:*:*:*:*
cpe:2.3:o:amd:epyc_7713p_firmware:milanpi_1.0.0.9:*:*:*:*:*:*:*
cpe:2.3:o:amd:epyc_7763_firmware:milanpi_1.0.0.9:*:*:*:*:*:*:*
cpe:2.3:o:amd:epyc_7773x_firmware:milanpi_1.0.0.9:*:*:*:*:*:*:*
cpe:2.3:o:amd:epyc_7232p_firmware:romepi_1.0.0.e:*:*:*:*:*:*:*
cpe:2.3:o:amd:epyc_7252_firmware:romepi_1.0.0.e:*:*:*:*:*:*:*
cpe:2.3:o:amd:epyc_7262_firmware:romepi_1.0.0.e:*:*:*:*:*:*:*
cpe:2.3:o:amd:epyc_7272_firmware:romepi_1.0.0.e:*:*:*:*:*:*:*
cpe:2.3:o:amd:epyc_7282_firmware:romepi_1.0.0.e:*:*:*:*:*:*:*
cpe:2.3:o:amd:epyc_7302_firmware:romepi_1.0.0.e:*:*:*:*:*:*:*
cpe:2.3:o:amd:epyc_7302p_firmware:romepi_1.0.0.e:*:*:*:*:*:*:*
cpe:2.3:o:amd:epyc_7352_firmware:romepi_1.0.0.e:*:*:*:*:*:*:*
cpe:2.3:o:amd:epyc_7402_firmware:romepi_1.0.0.e:*:*:*:*:*:*:*
cpe:2.3:o:amd:epyc_7402p_firmware:romepi_1.0.0.e:*:*:*:*:*:*:*
cpe:2.3:o:amd:epyc_7452_firmware:romepi_1.0.0.e:*:*:*:*:*:*:*
cpe:2.3:o:amd:epyc_7502_firmware:romepi_1.0.0.e:*:*:*:*:*:*:*
cpe:2.3:o:amd:epyc_7502p_firmware:romepi_1.0.0.e:*:*:*:*:*:*:*
cpe:2.3:o:amd:epyc_7532_firmware:romepi_1.0.0.e:*:*:*:*:*:*:*
cpe:2.3:o:amd:epyc_7542_firmware:romepi_1.0.0.e:*:*:*:*:*:*:*
cpe:2.3:o:amd:epyc_7552_firmware:romepi_1.0.0.e:*:*:*:*:*:*:*
cpe:2.3:o:amd:epyc_7642_firmware:romepi_1.0.0.e:*:*:*:*:*:*:*
+23 more

Affected products

Product	Versions
AMD · Ryzen™ 2000 series Desktop Processors “Raven Ridge” AM4	affected various
AMD · Ryzen™ 2000 Series Desktop Processors “Pinnacle Ridge”	affected various
AMD · Ryzen™ 3000 Series Desktop Processors “Matisse” AM4	affected various
AMD · AMD Ryzen™ 5000 Series Desktop Processors “Vermeer” AM4	affected various
AMD · Ryzen™ 5000 Series Desktop processor with Radeon™ Graphics “Cezanne” AM4	affected Various
AMD · 2nd Gen AMD Ryzen™ Threadripper™ Processors “Colfax”	affected various
AMD · 3rd Gen AMD Ryzen™ Threadripper™ Processors “Castle Peak” HEDT	affected various
AMD · Ryzen™ Threadripper™ PRO Processors “Castle Peak” WS	affected various
AMD · Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics “Dali”/”Dali” ULP	affected various
AMD · Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics “Pollock”	affected various
AMD · Ryzen™ 2000 Series Mobile Processors “Raven Ridge” FP5	affected various
AMD · Ryzen™ 3000 Series Mobile processor, 2nd Gen AMD Ryzen™ Mobile Processors with Radeon™ Graphics “Picasso”	affected various
AMD · Ryzen™ 3000 Series Mobile Processors with Radeon™ Graphics “Renoir”	affected various
AMD · Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics “Lucienne”	affected various
AMD · Ryzen™ 5000 Series Mobile processors with Radeon™ Graphics “Cezanne”	affected various
AMD · 1st Gen AMD EPYC™ Processors	affected various
AMD · 2nd Gen AMD EPYC™ Processors	affected various
AMD · 3rd Gen AMD EPYC™ Processors	affected various

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD

💣 AMD Ryzen™ 2000 series Desktop Processors “Raven Ridge” AM4