Vigie VulnDBEuropean-hosted Vulnerability DB
FR
Menu

AMD AMD EPYCâ„¢ 7001 Series

CVE-2024-36347
MEDIUM 6.4

At a glance

Source
NVD
EPSS
EPSS 0.11 % · percentile 1 ()
State
PUBLISHED
Published
Updated
Assigner
AMD
NVD status
Deferred

Search on…

Description

Improper signature verification in AMD CPU ROM microcode patch loader may allow an attacker with local administrator privilege to load malicious microcode, potentially resulting in loss of integrity of x86 instruction execution, loss of confidentiality and integrity of data in x86 CPU privileged context and compromise of SMM execution environment.

Weaknesses (CWE)

  • CWE-347 — Improper Verification of Cryptographic Signature

References

Scores

VersionScoreVectorScored by
CVSS 3.1MEDIUM 6.4CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:HAMD
CVSS 3.1MEDIUM 6.4CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:HNVD · psirt@amd.com (Secondary)

European references

CERT-FR advisories

Affected products

ProductVersions
AMD · AMD EPYC™ 7001 Seriesunaffected NaplesPI 1.0.0.P
AMD · AMD EPYC™ 7002 Seriesunaffected RomePI 1.0.0.L
AMD · AMD EPYC™ 7003 Seriesunaffected MilanPI 1.0.0.F
AMD · AMD EPYC™ 9004 Seriesunaffected Genoa 1.0.0.E
AMD · AMD EPYC™ 4004 Seriesunaffected ComboAM5PI1.0.0.a ; unaffected ComboAM5PI1.1.0.3c ; unaffected ComboAM5PI1.2.0.3
AMD · AMD EPYC™ 9005 Seriesunaffected TurinPI 1.0.0.4
AMD · AMD Instinct™ MI300Aunaffected MI300PI_SR5 1.0.0.8
AMD · AMD Ryzen™ 5000 Series Desktop Processorsunaffected ComboAM4v2PI 1.2.0.E
AMD · AMD Ryzen™ 5000 Series Desktop Processor with Radeon™ Graphicsunaffected ComboAM4v2PI 1.2.0.E
AMD · AMD Ryzen™ 3000 Series Desktop Processorsunaffected ComboAM4PI 1.0.0.D ; unaffected ComboAM4v2PI 1.2.0.E
AMD · AMD Athlon™ 3000 Series Desktop Processors with Radeon™ Graphicsunaffected ComboAM4PI 1.0.0.D ; unaffected ComboAM4v2PI 1.2.0.E
AMD · AMD Ryzen™ 7000 Series Desktop Processorsunaffected ComboAM5PI 1.0.0.a ; unaffected ComboAM5PI 1.1.0.3c ; unaffected ComboAM5PI 1.2.0.3
AMD · AMD Ryzen™ 4000 Series Desktop Processor with Radeon™ Graphicsunaffected ComboAM4v2PI 1.2.0.E
AMD · AMD Ryzen™ 8000 Series Processor with Radeon™ Graphicsunaffected ComboAM5PI 1.1.0.3c ; unaffected ComboAM5PI 1.2.0.3
AMD · AMD Ryzen™ 9000 Series Desktop Processorsunaffected ComboAM5PI 1.2.0.3c
AMD · AMD Ryzen™ Threadripper™ 3000 Series Processorsunaffected CastlePeakPI-SP3r3 1.0.0.E
AMD · AMD Ryzen™ Threadripper™ PRO 7000 WX-Series Processorsunaffected StormPeakPI-SP6 1.0.0.1k ; unaffected StormPeakPI-SP6 1.1.0.0i
AMD · AMD Ryzen™ Threadripper™ PRO 3000WX Series Processorsunaffected ChagallWSPI-sWRX8 1.0.0.B ; unaffected CastlePeakWSPI-sWRX8 1.0.0.g
AMD · AMD Ryzen™ Threadripper™ PRO 5000WX- Series Desktop Processorsunaffected ChagallWSPI-sWRX8 1.0.0.B
AMD · AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphicsunaffected PicassoPI-FP5 1.0.1.2b

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD