{"id":"CVE-2021-46754","aliases":["EUVD-2021-33410","GHSA-gqvv-8rrx-g836"],"status":"published","title":"Insufficient input validation in the ASP (AMD\nSecure Processor) bootloader may allow an attacker...","description":"Insufficient input validation in the ASP (AMD\nSecure Processor) bootloader may allow an attacker with a compromised Uapp or\nABL to coerce the bootloader into exposing sensitive information to the SMU\n(System Management Unit) resulting in a potential loss of confidentiality and\nintegrity.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00565,"percentile":0.47222,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-20"],"published":"2023-05-09T19:00:16Z","modified":"2026-06-17T04:15:26Z","products":[{"vendor":"amd","product":"amd ryzen™ embedded r1000"},{"vendor":"amd","product":"amd ryzen™ embedded r2000"},{"vendor":"amd","product":"amd ryzen™ embedded v1000"},{"vendor":"amd","product":"amd ryzen™ embedded v2000"},{"vendor":"amd","product":"athlon_gold_3150g_firmware"},{"vendor":"amd","product":"athlon_gold_3150ge_firmware"},{"vendor":"amd","product":"athlon_silver_3050ge_firmware"},{"vendor":"amd","product":"athlon™ 3000 series mobile processors with radeon™ graphics   “pollock”"},{"vendor":"amd","product":"athlon™ 3000 series mobile processors with radeon™ graphics “dali”/”dali” ulp"},{"vendor":"amd","product":"ryzen_1200_\\(af\\)_firmware"},{"vendor":"amd","product":"ryzen_1600_\\(af\\)_firmware"},{"vendor":"amd","product":"ryzen_2200g_firmware"},{"vendor":"amd","product":"ryzen_2200ge_firmware"},{"vendor":"amd","product":"ryzen_2300x_firmware"},{"vendor":"amd","product":"ryzen_2400g_firmware"},{"vendor":"amd","product":"ryzen_2400ge_firmware"},{"vendor":"amd","product":"ryzen_2500x_firmware"},{"vendor":"amd","product":"ryzen_2600_firmware"},{"vendor":"amd","product":"ryzen_2600e_firmware"},{"vendor":"amd","product":"ryzen_2600x_firmware"},{"vendor":"amd","product":"ryzen_2700_firmware"},{"vendor":"amd","product":"ryzen_2700e_firmware"},{"vendor":"amd","product":"ryzen_2700x_firmware"},{"vendor":"amd","product":"ryzen_2920x_firmware"},{"vendor":"amd","product":"ryzen_2950x_firmware"},{"vendor":"amd","product":"ryzen_2970wx_firmware"},{"vendor":"amd","product":"ryzen_2990wx_firmware"},{"vendor":"amd","product":"ryzen_3100_firmware"},{"vendor":"amd","product":"ryzen_3300x_firmware"},{"vendor":"amd","product":"ryzen_3500_firmware"},{"vendor":"amd","product":"ryzen_3500x_firmware"},{"vendor":"amd","product":"ryzen_3600_firmware"},{"vendor":"amd","product":"ryzen_3600x_firmware"},{"vendor":"amd","product":"ryzen_3600xt_firmware"},{"vendor":"amd","product":"ryzen_3800x_firmware"},{"vendor":"amd","product":"ryzen_3800xt_firmware"},{"vendor":"amd","product":"ryzen_3900_firmware"},{"vendor":"amd","product":"ryzen_3900x_firmware"},{"vendor":"amd","product":"ryzen_3900xt_firmware"},{"vendor":"amd","product":"ryzen_3950x_firmware"},{"vendor":"amd","product":"ryzen_5300g_firmware"},{"vendor":"amd","product":"ryzen_5300ge_firmware"},{"vendor":"amd","product":"ryzen_5500_firmware"},{"vendor":"amd","product":"ryzen_5600_firmware"},{"vendor":"amd","product":"ryzen_5600g_firmware"},{"vendor":"amd","product":"ryzen_5600ge_firmware"},{"vendor":"amd","product":"ryzen_5600x_firmware"},{"vendor":"amd","product":"ryzen_5700g_firmware"},{"vendor":"amd","product":"ryzen_5700ge_firmware"},{"vendor":"amd","product":"ryzen_5700x_firmware"},{"vendor":"amd","product":"ryzen_5800_firmware"},{"vendor":"amd","product":"ryzen_5800x3d_firmware"},{"vendor":"amd","product":"ryzen_5800x_firmware"},{"vendor":"amd","product":"ryzen_5900_firmware"},{"vendor":"amd","product":"ryzen_5900x_firmware"},{"vendor":"amd","product":"ryzen_5945wx_firmware"},{"vendor":"amd","product":"ryzen_5950x_firmware"},{"vendor":"amd","product":"ryzen_5955wx_firmware"},{"vendor":"amd","product":"ryzen_5965wx_firmware"},{"vendor":"amd","product":"ryzen_5975wx_firmware"},{"vendor":"amd","product":"ryzen_5995wx_firmware"},{"vendor":"amd","product":"ryzen_pro_2100ge_firmware"},{"vendor":"amd","product":"ryzen™ 2000 series desktop processors “raven ridge” am4"},{"vendor":"amd","product":"ryzen™ 2000 series mobile processors “raven ridge” fp5"},{"vendor":"amd","product":"ryzen™ 3000 series mobile processor, 2nd gen amd ryzen™ mobile processors with radeon™ graphics “picasso”"},{"vendor":"amd","product":"ryzen™ 3000 series mobile processors with radeon™ graphics “renoir”"},{"vendor":"amd","product":"ryzen™ 5000 series desktop processor with radeon™ graphics  “cezanne” am4"},{"vendor":"amd","product":"ryzen™ 5000 series mobile processors with radeon™ graphics “cezanne”"},{"vendor":"amd","product":"ryzen™ 5000 series mobile processors with radeon™ graphics “lucienne”"}],"references":[{"url":"https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-4001","tags":["vendor-advisory","x_transferred","Vendor Advisory"]},{"url":"https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-5001","tags":["x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-46754"},{"url":"https://github.com/advisories/GHSA-gqvv-8rrx-g836"}],"sources":{"cve":[{"id":"CVE-2021-46754","description":"Insufficient input validation in the ASP (AMD\nSecure Processor) bootloader may allow an attacker with a compromised Uapp or\nABL to coerce the bootloader into exposing sensitive information to the SMU\n(System Management Unit) resulting in a potential loss of confidentiality and\nintegrity.\n\n\n\n\n\n\n\n\n","status":"published","published":"2023-05-09T19:00:16.712Z","modified":"2024-08-04T05:17:42.313Z","updated_at":"2026-11-02T14:33:02.930115Z"}],"euvd":[{"id":"EUVD-2021-33410","description":"Insufficient input validation in the ASP (AMD\nSecure Processor) bootloader may allow an attacker with a compromised Uapp or\nABL to coerce the bootloader into exposing sensitive information to the SMU\n(System Management Unit) resulting in a potential loss of confidentiality and\nintegrity.\n\n\n\n\n\n\n\n\n","status":"published","published":"2023-05-09T19:00:16Z","modified":"2024-08-04T05:17:42Z","updated_at":"2026-11-03T03:08:22.448202Z"}],"ghsa":[{"id":"GHSA-gqvv-8rrx-g836","title":"Insufficient input validation in the ASP (AMD\nSecure Processor) bootloader may allow an attacker...","description":"Insufficient input validation in the ASP (AMD\nSecure Processor) bootloader may allow an attacker with a compromised Uapp or\nABL to coerce the bootloader into exposing sensitive information to the SMU\n(System Management Unit) resulting in a potential loss of confidentiality and\nintegrity.\n\n\n\n\n\n\n\n\n","status":"published","published":"2023-05-09T21:30:23Z","modified":"2026-03-22T05:07:09Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:06:46.535326Z"}],"nvd":[{"id":"CVE-2021-46754","description":"Insufficient input validation in the ASP (AMD\nSecure Processor) bootloader may allow an attacker with a compromised Uapp or\nABL to coerce the bootloader into exposing sensitive information to the SMU\n(System Management Unit) resulting in a potential loss of confidentiality and\nintegrity.\n\n\n\n\n\n\n\n\n","status":"published","published":"2023-05-09T20:15:12.103Z","modified":"2026-06-17T04:15:26.98Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:07:07.764332Z"}]}}