Strix
26.1K

CVE-2021-26392

HIGHCVSS 7.8/10EPSS 0.26%

Last modified

CVE-2021-26392 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. Insufficient verification of missing size check in 'LoadModule' may lead to an out-of-bounds write potentially allowing an attacker with privileges to gain code execution of the OS/kernel by loading a malicious TA.. EPSS estimates a 0.26% chance of exploitation in the next 30 days.

Description

Insufficient verification of missing size check in 'LoadModule' may lead to an out-of-bounds write potentially allowing an attacker with privileges to gain code execution of the OS/kernel by loading a malicious TA.

Metrics

CVSS 3.1
7.8/10

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Probability
0.26%

17.2th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
AmdEnterprise Driver< 22.10.20
AmdRadeon Pro Software< 22.q2
AmdRadeon Software< 22.5.2
AmdRadeon Rx Vega 56 FirmwareAll versions
AmdRadeon Rx Vega 64 FirmwareAll versions
AmdRyzen 3 2200ge FirmwareAll versions
AmdRyzen 3 2200g FirmwareAll versions
AmdRyzen 5 2400ge FirmwareAll versions
AmdRyzen 5 2400g FirmwareAll versions
AmdRyzen 3 3100 FirmwareAll versions
AmdRyzen 3 3300x FirmwareAll versions
AmdRyzen 5 3500 FirmwareAll versions
AmdRyzen 5 3500x FirmwareAll versions
AmdRyzen 5 3600 FirmwareAll versions
AmdRyzen 5 3600x FirmwareAll versions
AmdRyzen 5 3600xt FirmwareAll versions
AmdRyzen 7 3700x FirmwareAll versions
AmdRyzen 7 3800x FirmwareAll versions
AmdRyzen 7 3800xt FirmwareAll versions
AmdRyzen 9 3900 FirmwareAll versions
AmdRyzen 9 3900x FirmwareAll versions
AmdRyzen 9 3900xt FirmwareAll versions
AmdRyzen 9 3950x FirmwareAll versions
AmdRyzen 5 5500 FirmwareAll versions
AmdRyzen 5 5600 FirmwareAll versions
AmdRyzen 5 5600x FirmwareAll versions
AmdRyzen 7 5700x FirmwareAll versions
AmdRyzen 7 5800x FirmwareAll versions
AmdRyzen 7 5800 FirmwareAll versions
AmdRyzen 7 5800x3d FirmwareAll versions
AmdRyzen 9 5900 FirmwareAll versions
AmdRyzen 9 5900x FirmwareAll versions
AmdRyzen 9 5950x FirmwareAll versions
AmdRyzen 3 5300ge FirmwareAll versions
AmdRyzen 3 5300g FirmwareAll versions
AmdRyzen 5 5600ge FirmwareAll versions
AmdRyzen 5 5600g FirmwareAll versions
AmdRyzen 7 5700ge FirmwareAll versions
AmdRyzen 7 5700g FirmwareAll versions
AmdRyzen Threadripper 3960x FirmwareAll versions
AmdRyzen Threadripper 3970x FirmwareAll versions
AmdRyzen Threadripper 3990x FirmwareAll versions
AmdRyzen Threadripper Pro 3945wx FirmwareAll versions
AmdRyzen Threadripper Pro 3955wx FirmwareAll versions
AmdRyzen Threadripper Pro 3975wx FirmwareAll versions
AmdRyzen Threadripper Pro 3995wx FirmwareAll versions
AmdRyzen Threadripper Pro 5945wx FirmwareAll versions
AmdRyzen Threadripper Pro 5955wx FirmwareAll versions
AmdRyzen Threadripper Pro 5965wx FirmwareAll versions
AmdRyzen Threadripper Pro 5975wx FirmwareAll versions

Showing 50 of 103 affected configurations. See NVD for the full list.

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2021-26392?
Insufficient verification of missing size check in 'LoadModule' may lead to an out-of-bounds write potentially allowing an attacker with privileges to gain code execution of the OS/kernel by loading a malicious TA.
How severe is CVE-2021-26392?
CVE-2021-26392 has a CVSS score of 7.8/10 (HIGH severity). The EPSS model estimates a 0.26% probability of exploitation in the next 30 days.
How do I fix CVE-2021-26392?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2021-26392?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST