CVE Feed

    Dashboard / CVE / CVE-2021-46766

    CVE-2021-46766

    Improper clearing of sensitive data in the ASP Bootloader may expose secret keys to a privileged attacker accessing ASP SRAM, potentially leading to a loss of confidentiality.

    Published:Nov 14, 2023
    Last Modified:Nov 21, 2024
    EPS:Nov 14, 2023
    EPSS Score:0.00021
    CVSS Score:2.5

    Affected Products

    Vendor
    Amd
    Product
    Epyc 9124
    Vendor
    Amd
    Product
    Epyc 9124 Firmware
    Vendor
    Amd
    Product
    Epyc 9174f
    Vendor
    Amd
    Product
    Epyc 9174f Firmware
    Vendor
    Amd
    Product
    Epyc 9184x
    Vendor
    Amd
    Product
    Epyc 9184x Firmware
    Vendor
    Amd
    Product
    Epyc 9224
    Vendor
    Amd
    Product
    Epyc 9224 Firmware
    Vendor
    Amd
    Product
    Epyc 9254
    Vendor
    Amd
    Product
    Epyc 9254 Firmware
    Vendor
    Amd
    Product
    Epyc 9274f
    Vendor
    Amd
    Product
    Epyc 9274f Firmware
    Vendor
    Amd
    Product
    Epyc 9334
    Vendor
    Amd
    Product
    Epyc 9334 Firmware
    Vendor
    Amd
    Product
    Epyc 9354
    Vendor
    Amd
    Product
    Epyc 9354 Firmware
    Vendor
    Amd
    Product
    Epyc 9354p
    Vendor
    Amd
    Product
    Epyc 9354p Firmware
    Vendor
    Amd
    Product
    Epyc 9374f
    Vendor
    Amd
    Product
    Epyc 9374f Firmware
    Vendor
    Amd
    Product
    Epyc 9384x
    Vendor
    Amd
    Product
    Epyc 9384x Firmware
    Vendor
    Amd
    Product
    Epyc 9454
    Vendor
    Amd
    Product
    Epyc 9454 Firmware
    Vendor
    Amd
    Product
    Epyc 9454p
    Vendor
    Amd
    Product
    Epyc 9454p Firmware
    Vendor
    Amd
    Product
    Epyc 9474f
    Vendor
    Amd
    Product
    Epyc 9474f Firmware
    Vendor
    Amd
    Product
    Epyc 9534
    Vendor
    Amd
    Product
    Epyc 9534 Firmware
    Vendor
    Amd
    Product
    Epyc 9554
    Vendor
    Amd
    Product
    Epyc 9554 Firmware
    Vendor
    Amd
    Product
    Epyc 9554p
    Vendor
    Amd
    Product
    Epyc 9554p Firmware
    Vendor
    Amd
    Product
    Epyc 9634
    Vendor
    Amd
    Product
    Epyc 9634 Firmware
    Vendor
    Amd
    Product
    Epyc 9654
    Vendor
    Amd
    Product
    Epyc 9654 Firmware
    Vendor
    Amd
    Product
    Epyc 9654p
    Vendor
    Amd
    Product
    Epyc 9654p Firmware
    Vendor
    Amd
    Product
    Epyc 9684x
    Vendor
    Amd
    Product
    Epyc 9684x Firmware
    Vendor
    Amd
    Product
    Epyc 9734
    Vendor
    Amd
    Product
    Epyc 9734 Firmware
    Vendor
    Amd
    Product
    Epyc 9754
    Vendor
    Amd
    Product
    Epyc 9754 Firmware
    Vendor
    Amd
    Product
    Epyc 9754s
    Vendor
    Amd
    Product
    Epyc 9754s Firmware
    Vendor
    Amd
    Product
    Ryzen Threadripper Pro 3945wx
    Vendor
    Amd
    Product
    Ryzen Threadripper Pro 3945wx Firmware
    Vendor
    Amd
    Product
    Ryzen Threadripper Pro 3955wx
    Vendor
    Amd
    Product
    Ryzen Threadripper Pro 3955wx Firmware
    Vendor
    Amd
    Product
    Ryzen Threadripper Pro 3975wx
    Vendor
    Amd
    Product
    Ryzen Threadripper Pro 3975wx Firmware
    Vendor
    Amd
    Product
    Ryzen Threadripper Pro 3995wx
    Vendor
    Amd
    Product
    Ryzen Threadripper Pro 3995wx Firmware

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-459 Incomplete Cleanup

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2023-20591 (CVSS 6.5) — Improper re-initialization of IOMMU during the DRTM event may permit an untrusted platform configuration to pe…
    CVE-2023-20578 (CVSS 7.5) — A TOCTOU (Time-Of-Check-Time-Of-Use) in SMM may allow an attacker with ring0 privileges and access to the BIOS…
    CVE-2023-20584 (CVSS 5.3) — IOMMU improperly handles certain special address ranges with invalid device table entries (DTEs), which may al…
    CVE-2024-21980 (CVSS 7.9) — Improper restriction of write operations in SNP firmware could allow a malicious hypervisor to potentially ove…
    CVE-2023-31355 (CVSS 6) — Improper restriction of write operations in SNP firmware could allow a malicious hypervisor to overwrite a gue…
    CVE-2024-21978 (CVSS 6) — Improper input validation in SEV-SNP could allow a malicious hypervisor to read or overwrite guest memory pote…
    CVE-2023-20573 (CVSS 3.2) — A privileged attacker can prevent delivery of debug exceptions to SEV-SNP guests potentially resulting in gues…
    CVE-2023-31346 (CVSS 6) — Failure to initialize memory in SEV Firmware may allow a privileged attacker to access stale data from other g…
    CVE-2023-31347 (CVSS 4.9) — Due to a code bug in Secure_TSC, SEV firmware may allow an attacker with high privileges to cause a guest to o…
    CVE-2023-20566 (CVSS 5.3) — Improper address validation in ASP with SNP enabled may potentially allow an attacker to compromise guest memo…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High