CVE-2021-26367

Severity: medium (CVSS 6.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-08-13 · updated 2026-06-17

Description

A malicious attacker in x86 can misconfigure the Trusted Memory Regions (TMRs), which may allow the attacker to set an arbitrary address range for the TMR, potentially leading to a loss of integrity and availability.

Affected products

AMD Athlon Gold 3150C Firmware: before picassopi-fp5_1.0.0.e — fixed in picassopi-fp5_1.0.0.e
AMD Athlon Gold 3150G Firmware: before comboam4pi_1.0.0.9 — fixed in comboam4pi_1.0.0.9
AMD Athlon Gold 3150U Firmware: before picassopi-fp5_1.0.0.e — fixed in picassopi-fp5_1.0.0.e
AMD Athlon Gold Pro 3150G Firmware: before comboam4pi_1.0.0.9 — fixed in comboam4pi_1.0.0.9
AMD Athlon Gold Pro 3150Ge Firmware: before comboam4pi_1.0.0.9 — fixed in comboam4pi_1.0.0.9
AMD Athlon Pro 300Ge Firmware: before comboam4pi_1.0.0.9 — fixed in comboam4pi_1.0.0.9
AMD Athlon Pro 3045B Firmware: before picassopi-fp5_1.0.0.e — fixed in picassopi-fp5_1.0.0.e
AMD Athlon Pro 3145B Firmware: before picassopi-fp5_1.0.0.e — fixed in picassopi-fp5_1.0.0.e
AMD Athlon Silver 3050C Firmware: before picassopi-fp5_1.0.0.e — fixed in picassopi-fp5_1.0.0.e
AMD Athlon Silver 3050E Firmware: before picassopi-fp5_1.0.0.e — fixed in picassopi-fp5_1.0.0.e
AMD Athlon Silver 3050U Firmware: before picassopi-fp5_1.0.0.e — fixed in picassopi-fp5_1.0.0.e
AMD Radeon Software: before 23.12.1; through 23.q4 — fixed in 23.12.1
AMD Ryzen 3 3300U Firmware: before picassopi-fp5_1.0.0.e — fixed in picassopi-fp5_1.0.0.e
AMD Ryzen 3 3350U Firmware: before picassopi-fp5_1.0.0.e — fixed in picassopi-fp5_1.0.0.e
AMD Ryzen 3 4300G Firmware: before comboam4v2_pi_1.2.0.5 — fixed in comboam4v2_pi_1.2.0.5
AMD Ryzen 3 4300Ge Firmware: before comboam4v2_pi_1.2.0.5 — fixed in comboam4v2_pi_1.2.0.5
AMD Ryzen 3 5300G Firmware: before comboam4v2_pi_1.2.0.5 — fixed in comboam4v2_pi_1.2.0.5
AMD Ryzen 3 5300Ge Firmware: before comboam4v2_pi_1.2.0.5 — fixed in comboam4v2_pi_1.2.0.5
AMD Ryzen 5 3450U Firmware: before picassopi-fp5_1.0.0.e — fixed in picassopi-fp5_1.0.0.e
AMD Ryzen 5 3500C Firmware: before picassopi-fp5_1.0.0.e — fixed in picassopi-fp5_1.0.0.e
AMD Ryzen 5 3500U Firmware: before picassopi-fp5_1.0.0.e — fixed in picassopi-fp5_1.0.0.e
AMD Ryzen 5 3550H Firmware: before picassopi-fp5_1.0.0.e — fixed in picassopi-fp5_1.0.0.e
AMD Ryzen 5 3580U Firmware: before picassopi-fp5_1.0.0.e — fixed in picassopi-fp5_1.0.0.e
AMD Ryzen 5 4600G Firmware: before comboam4v2_pi_1.2.0.5 — fixed in comboam4v2_pi_1.2.0.5
AMD Ryzen 5 4600Ge Firmware: before comboam4v2_pi_1.2.0.5 — fixed in comboam4v2_pi_1.2.0.5
AMD Ryzen 5 5600G Firmware: before comboam4v2_pi_1.2.0.5 — fixed in comboam4v2_pi_1.2.0.5
AMD Ryzen 5 5600Ge Firmware: before comboam4v2_pi_1.2.0.5 — fixed in comboam4v2_pi_1.2.0.5
AMD Ryzen 7 3700C Firmware: before picassopi-fp5_1.0.0.e — fixed in picassopi-fp5_1.0.0.e
AMD Ryzen 7 3700U Firmware: before picassopi-fp5_1.0.0.e — fixed in picassopi-fp5_1.0.0.e
AMD Ryzen 7 3750H Firmware: before picassopi-fp5_1.0.0.e — fixed in picassopi-fp5_1.0.0.e

How to fix

Upgrade to a fixed version: AMD Athlon Gold 3150C Firmware picassopi-fp5_1.0.0.e; AMD Athlon Gold 3150G Firmware comboam4pi_1.0.0.9; AMD Athlon Gold 3150U Firmware picassopi-fp5_1.0.0.e; AMD Athlon Gold Pro 3150G Firmware comboam4pi_1.0.0.9; AMD Athlon Gold Pro 3150Ge Firmware comboam4pi_1.0.0.9; AMD Athlon Pro 300Ge Firmware comboam4pi_1.0.0.9; AMD Athlon Pro 3045B Firmware picassopi-fp5_1.0.0.e; AMD Athlon Pro 3145B Firmware picassopi-fp5_1.0.0.e; AMD Athlon Silver 3050C Firmware picassopi-fp5_1.0.0.e; AMD Athlon Silver 3050E Firmware picassopi-fp5_1.0.0.e; AMD Athlon Silver 3050U Firmware picassopi-fp5_1.0.0.e; AMD Radeon Software 23.12.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-26367 or the next vulnerability affects your stack