CVE-2021-46795 - Vulnerability Details - OpenCVE

A TOCTOU (time-of-check to time-of-use) vulnerability exists where an attacker may use a compromised BIOS to cause the TEE OS to read memory out of bounds that could potentially result in a denial of service.

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Amd	Cezannepi-fp6 Cezannepi-fp6 Firmware Comboam4v2 Pi Comboam4v2 Pi Firmware Renoirpi-fp6 Firmware

Configuration 1 [-]

AND

cpe:2.3:o:amd:comboam4v2_pi_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:amd:comboam4v2_pi:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:amd:renoirpi-fp6_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:amd:comboam4v2_pi:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:o:amd:cezannepi-fp6_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:amd:cezannepi-fp6:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://nvd.nist.gov/vuln/detail/CVE-2021-46795
https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1031
https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1031
https://www.cve.org/CVERecord?id=CVE-2021-46795

History

Wed, 09 Apr 2025 16:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: AMD

Published: 2023-01-10T20:53:25.868Z

Updated: 2025-04-09T15:13:26.855Z

Reserved: 2022-05-04T18:14:06.438Z

Link: CVE-2021-46795

Vulnrichment

Updated: 2024-08-04T05:17:42.312Z

NVD

Status : Modified

Published: 2023-01-11T08:15:13.347

Modified: 2025-04-09T15:15:45.247

Link: CVE-2021-46795

Redhat

Severity : Low

Publid Date: 2023-01-10T06:30:00Z

Links: CVE-2021-46795 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2021-46795", "assignerOrgId": "b58fc414-a1e4-4f92-9d70-1add41838648", "state": "PUBLISHED", "assignerShortName": "AMD", "dateReserved": "2022-05-04T18:14:06.438Z", "datePublished": "2023-01-10T20:53:25.868Z", "dateUpdated": "2025-04-09T15:13:26.855Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "packageName": "AGESA", "platforms": ["x86"], "product": "Ryzen 5000 Series", "vendor": " AMD", "versions": [{"status": "affected", "version": "various "}]}, {"defaultStatus": "unaffected", "packageName": "AGESA", "platforms": ["x86"], "product": "Ryzen 3000 Series ", "vendor": " AMD", "versions": [{"status": "affected", "version": "various "}]}], "datePublic": "2023-01-10T17:30:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "A TOCTOU (time-of-check to time-of-use) vulnerability exists where an attacker may use a compromised BIOS to cause the TEE OS to read memory out of bounds that could potentially result in a denial of service."}], "value": "A TOCTOU (time-of-check to time-of-use) vulnerability exists where an attacker may use a compromised BIOS to cause the TEE OS to read memory out of bounds that could potentially result in a denial of service."}], "providerMetadata": {"orgId": "b58fc414-a1e4-4f92-9d70-1add41838648", "shortName": "AMD", "dateUpdated": "2023-01-11T07:01:59.843Z"}, "references": [{"url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1031"}], "source": {"advisory": "AMD-SB-1031", "discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:17:42.312Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1031", "tags": ["x_transferred"]}]}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-367", "lang": "en", "description": "CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-04-09T15:13:22.667024Z", "id": "CVE-2021-46795", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-09T15:13:26.855Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1031", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:17:42.312Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2021-46795", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-04-09T15:13:22.667024Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-367", "description": "CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-09T15:13:17.717Z"}}], "cna": {"source": {"advisory": "AMD-SB-1031", "discovery": "UNKNOWN"}, "affected": [{"vendor": " AMD", "product": "Ryzen 5000 Series", "versions": [{"status": "affected", "version": "various "}], "platforms": ["x86"], "packageName": "AGESA", "defaultStatus": "affected"}, {"vendor": " AMD", "product": "Ryzen 3000 Series ", "versions": [{"status": "affected", "version": "various "}], "platforms": ["x86"], "packageName": "AGESA", "defaultStatus": "unaffected"}], "datePublic": "2023-01-10T17:30:00.000Z", "references": [{"url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1031"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "A TOCTOU (time-of-check to time-of-use) vulnerability exists where an attacker may use a compromised BIOS to cause the TEE OS to read memory out of bounds that could potentially result in a denial of service.", "supportingMedia": [{"type": "text/html", "value": "A TOCTOU (time-of-check to time-of-use) vulnerability exists where an attacker may use a compromised BIOS to cause the TEE OS to read memory out of bounds that could potentially result in a denial of service.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "b58fc414-a1e4-4f92-9d70-1add41838648", "shortName": "AMD", "dateUpdated": "2023-01-11T07:01:59.843Z"}}}, "cveMetadata": {"cveId": "CVE-2021-46795", "state": "PUBLISHED", "dateUpdated": "2025-04-09T15:13:26.855Z", "dateReserved": "2022-05-04T18:14:06.438Z", "assignerOrgId": "b58fc414-a1e4-4f92-9d70-1add41838648", "datePublished": "2023-01-10T20:53:25.868Z", "assignerShortName": "AMD"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:amd:comboam4v2_pi_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "6D075A02-6278-43AB-8108-66DBA2FA3F50", "versionEndExcluding": "1.2.0.5", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:amd:comboam4v2_pi:-:*:*:*:*:*:*:*", "matchCriteriaId": "DAC265C7-A9A3-4156-9AB3-8F975AED6764", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:amd:renoirpi-fp6_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "0E0B55C4-452F-42AD-B00F-4A61CEED1337", "versionEndExcluding": "1.0.0.7", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:amd:comboam4v2_pi:-:*:*:*:*:*:*:*", "matchCriteriaId": "DAC265C7-A9A3-4156-9AB3-8F975AED6764", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:amd:cezannepi-fp6_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "5CEF152D-7D7D-4632-BCDA-FA46A8D8AA12", "versionEndExcluding": "1.0.0.6", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:amd:cezannepi-fp6:-:*:*:*:*:*:*:*", "matchCriteriaId": "DBE05F55-E039-486A-B3E0-E1CC3BF81049", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A TOCTOU (time-of-check to time-of-use) vulnerability exists where an attacker may use a compromised BIOS to cause the TEE OS to read memory out of bounds that could potentially result in a denial of service."}, {"lang": "es", "value": "Existe una vulnerabilidad TOCTOU (time-of-check to time-of-use) donde un atacante puede usar un BIOS comprometido para hacer que TEE OS lea la memoria fuera de los l\u00edmites, lo que potencialmente podr\u00eda resultar en una denegaci\u00f3n de servicio."}], "id": "CVE-2021-46795", "lastModified": "2025-04-09T15:15:45.247", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2023-01-11T08:15:13.347", "references": [{"source": "psirt@amd.com", "tags": ["Vendor Advisory"], "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1031"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1031"}], "sourceIdentifier": "psirt@amd.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-367"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-367"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}