What is the severity of CVE-2021-26364?

CVE-2021-26364 is categorized as a critical vulnerability due to its potential to cause a denial of service through insufficient bounds checking.

How do I fix CVE-2021-26364?

To mitigate CVE-2021-26364, users should update the affected AMD EPYC firmware to the latest version available, specifically versions later than romepi-sp3_1.0.0.d or milanpi-sp3_1.0.0.7.

Who is affected by CVE-2021-26364?

CVE-2021-26364 affects multiple models of AMD EPYC processors with specific firmware versions.

What risks are associated with CVE-2021-26364?

The main risk with CVE-2021-26364 is the potential for denial of service, which could disrupt system availability.

Is there a known exploit for CVE-2021-26364?

As of now, there is no public knowledge of an active exploit for CVE-2021-26364, but the vulnerability poses a significant risk.

Vulnerability/
CVE-2021-26364

medium

5.5

CWE

119

10/5/2022

3/8/2024

CVE-2021-26364: Buffer Overflow

First published: Tue May 10 2022(Updated: )

Insufficient bounds checking in an SMU mailbox register could allow an attacker to potentially read outside of the SRAM address range which could result in an exception handling leading to a potential denial of service.

Credit: psirt@amd.com

Affected Software	Affected Version	How to fix
Amd Epyc 7232p Firmware	<romepi-sp3_1.0.0.d
Amd Epyc 7232p
Amd Epyc 7302p Firmware	<romepi-sp3_1.0.0.d
Amd Epyc 7302p
Amd Epyc 7402p Firmware	<romepi-sp3_1.0.0.d
Amd Epyc 7402p
Amd Epyc 7502p Firmware	<romepi-sp3_1.0.0.d
Amd Epyc 7502p
Amd Epyc 7702p Firmware	<romepi-sp3_1.0.0.d
Amd Epyc 7702p
Amd Epyc 7252 Firmware	<romepi-sp3_1.0.0.d
Amd Epyc 7252
Amd Epyc 7262 Firmware	<romepi-sp3_1.0.0.d
Amd Epyc 7262
Amd Epyc 7272 Firmware	<romepi-sp3_1.0.0.d
Amd Epyc 7272
Amd Epyc 7282 Firmware	<romepi-sp3_1.0.0.d
Amd Epyc 7282
Amd Epyc 7302 Firmware	<romepi-sp3_1.0.0.d
Amd Epyc 7302
Amd Epyc 7352 Firmware	<romepi-sp3_1.0.0.d
Amd Epyc 7352
Amd Epyc 7402 Firmware	<romepi-sp3_1.0.0.d
Amd Epyc 7402
Amd Epyc 7452 Firmware	<romepi-sp3_1.0.0.d
Amd Epyc 7452
Amd Epyc 7502 Firmware	<romepi-sp3_1.0.0.d
Amd Epyc 7502
Amd Epyc 7532 Firmware	<romepi-sp3_1.0.0.d
Amd Epyc 7532
Amd Epyc 7542 Firmware	<romepi-sp3_1.0.0.d
Amd Epyc 7542
Amd Epyc 7552 Firmware	<romepi-sp3_1.0.0.d
Amd Epyc 7552
Amd Epyc 7642 Firmware	<romepi-sp3_1.0.0.d
Amd Epyc 7642
Amd Epyc 7662 Firmware	<romepi-sp3_1.0.0.d
Amd Epyc 7662
Amd Epyc 7702 Firmware	<romepi-sp3_1.0.0.d
Amd Epyc 7702
Amd Epyc 7742 Firmware	<romepi-sp3_1.0.0.d
Amd Epyc 7742
Amd Epyc 7f32 Firmware	<romepi-sp3_1.0.0.d
Amd Epyc 7f32
Amd Epyc 7f52 Firmware	<romepi-sp3_1.0.0.d
Amd Epyc 7f52
Amd Epyc 7f72 Firmware	<romepi-sp3_1.0.0.d
Amd Epyc 7f72
Amd Epyc 7313p Firmware	<milanpi-sp3_1.0.0.7
Amd Epyc 7313p
Amd Epyc 7443p Firmware	<milanpi-sp3_1.0.0.7
Amd Epyc 7443p
Amd Epyc 7543p Firmware	<milanpi-sp3_1.0.0.7
Amd Epyc 7543p
Amd Epyc 7713p Firmware	<milanpi-sp3_1.0.0.7
Amd Epyc 7713p
Amd Epyc 7773x Firmware	<milanpi-sp3_1.0.0.7
Amd Epyc 7773x
Amd Epyc 7763 Firmware	<milanpi-sp3_1.0.0.7
Amd Epyc 7763
Amd Epyc 7713 Firmware	<milanpi-sp3_1.0.0.7
Amd Epyc 7713
Amd Epyc 7663 Firmware	<milanpi-sp3_1.0.0.7
Amd Epyc 7663
Amd Epyc 7643 Firmware	<milanpi-sp3_1.0.0.7
Amd Epyc 7643
Amd Epyc 7573x Firmware	<milanpi-sp3_1.0.0.7
Amd Epyc 7573x
Amd Epyc 75f3 Firmware	<milanpi-sp3_1.0.0.7
Amd Epyc 75f3
Amd Epyc 7513 Firmware	<milanpi-sp3_1.0.0.7
Amd Epyc 7513
Amd Epyc 7473x Firmware	<milanpi-sp3_1.0.0.7
Amd Epyc 7473x
Amd Epyc 7453 Firmware	<milanpi-sp3_1.0.0.7
Amd Epyc 7453
Amd Epyc 74f3 Firmware	<milanpi-sp3_1.0.0.7
Amd Epyc 74f3
Amd Epyc 7413 Firmware	<milanpi-sp3_1.0.0.7
Amd Epyc 7413
Amd Epyc 73f3 Firmware	<milanpi-sp3_1.0.0.7
Amd Epyc 73f3
Amd Epyc 7373x Firmware	<milanpi-sp3_1.0.0.7
Amd Epyc 7373x
Amd Epyc 7343 Firmware	<milanpi-sp3_1.0.0.7
Amd Epyc 7343
Amd Epyc 72f3 Firmware	<milanpi-sp3_1.0.0.7
Amd Epyc 72f3

Never miss a vulnerability like this again

Reference Links

https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1028

Frequently Asked Questions

What is the severity of CVE-2021-26364?
CVE-2021-26364 is categorized as a critical vulnerability due to its potential to cause a denial of service through insufficient bounds checking.
How do I fix CVE-2021-26364?
To mitigate CVE-2021-26364, users should update the affected AMD EPYC firmware to the latest version available, specifically versions later than romepi-sp3_1.0.0.d or milanpi-sp3_1.0.0.7.
Who is affected by CVE-2021-26364?
CVE-2021-26364 affects multiple models of AMD EPYC processors with specific firmware versions.
What risks are associated with CVE-2021-26364?
The main risk with CVE-2021-26364 is the potential for denial of service, which could disrupt system availability.
Is there a known exploit for CVE-2021-26364?
As of now, there is no public knowledge of an active exploit for CVE-2021-26364, but the vulnerability poses a significant risk.