CVE-2024-36354

State: Published
Severity: 7.5 High
Published: Sep 6, 2025
Updated: Feb 26, 2026
Reserved: May 23, 2024

Description

Improper input validation for DIMM serial presence detect (SPD) metadata could allow an attacker with physical access, ring0 access on a system with a non-compliant DIMM, or control over the Root of Trust for BIOS update, to bypass SMM isolation potentially resulting in arbitrary code execution at the SMM level.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H	AMD

Weaknesses

CWE-1231 Improper Prevention of Lock Bit Modification

Affected Products

Product	Versions
AMD Ryzen™ Threadripper™ 3000 ProcessorsAMD	CastlePeakPI-SP3r3 1.0.0.DNot affected
AMD Ryzen™ Threadripper™ PRO 5000 WX-Series ProcessorsAMD	ChagallWSPI-sWRX8-1.0.0.ANot affected
AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ GraphicsAMD	CezannePI-FP6_1.0.1.1aNot affected
AMD Ryzen™ Threadripper™ PRO 3000 WX-Series ProcessorsAMD	CastlePeakWSPI-sWRX8 1.0.0.FNot affected
AMD Ryzen™ Threadripper™ PRO 3000 WX-Series ProcessorsAMD	ChagallWSPI-sWRX8-1.0.0.ANot affected
AMD Ryzen™ 3000 Series Mobile Processors with Radeon™ GraphicsAMD	PicassoPI-FP5_1.0.1.2aNot affected
AMD Ryzen™ 8040 Series Mobile Processors with Radeon™ GraphicsAMD	PhoenixPI-FP8-FP7_1.1.8.0Not affected
AMD Athlon™ 3000 Series Mobile Processors with Radeon™ GraphicsAMD	PicassoPI-FP5_1.0.1.2aNot affected
AMD Ryzen™ 8000 Series Desktop ProcessorsAMD	ComboAM5PI_1.2.0.2aNot affected
AMD Ryzen™ 7040 Series Mobile Processors with Radeon™ GraphicsAMD	PhoenixPI-FP8-FP7_1.1.8.0Not affected
AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ GraphicsAMD	RenoirPI-FP6 1.0.0.EaNot affected
AMD Ryzen™ 6000 Series Processors with Radeon™ GraphicsAMD	RembrandtPI-FP7_1.0.0.BaNot affected
AMD Ryzen™ 7045 Series Mobile Processors with Radeon™ GraphicsAMD	DragonRangeFL1_1.0.0.3fNot affected
AMD Ryzen™ 7035 Series Processors with Radeon™ GraphicsAMD	RembrandtPI-FP7_1.0.0.BaNot affected
AMD Ryzen™ 7000 Series Desktop ProcessorsAMD	ComboAM5PI_1.2.0.2aNot affected
AMD Ryzen™ 7030 Series Mobile Processors with Radeon™ GraphicsAMD	CezannePI-FP6_1.0.1.1aNot affected
AMD Ryzen™ 9000 Series Desktop ProcessorsAMD	ComboAM5PI_1.2.0.2aNot affected
AMD Ryzen™ 3000 Series Desktop ProcessorsAMD	ComboAM4PI_1.0.0.CNot affected ComboAM4v2PI_1.2.0.DNot affected
AMD Athlon™ 3000 Series Desktop Processors with Radeon™ GraphicsAMD	ComboAM4PI_1.0.0.CNot affected
AMD Ryzen™ 5000 Series Desktop Processors with Radeon™ GraphicsAMD	ComboAM4v2PI_1.2.0.DNot affected
AMD Ryzen™ 4000 Series Desktop ProcessorsAMD	ComboAM4v2PI_1.2.0.DNot affected
AMD Ryzen™ 5000 Series Desktop ProcessorsAMD	ComboAM4v2PI_1.2.0.DNot affected
AMD EPYC™ Embedded 3000 Series ProcessorsAMD	SnowyOwl PI 1.1.0.FNot affected
AMD EPYC™ Embedded 7002 Series ProcessorsAMD	EmbRomePI-SP3_1.0.0.ENot affected
AMD EPYC™ Embedded 7003 Series ProcessorsAMD	EmbMilanPI-SP3 1.0.0.ANot affected
AMD EPYC™ Embedded 9004 Series ProcessorsAMD	EmbGenoaPI-SP5 1.0.0.8Not affected
AMD Ryzen™ Embedded 5000 Series ProcessorsAMD	EmbAM4PI 1.0.0.7Not affected
AMD Ryzen™ Embedded V2000 Series ProcessorsAMD	EmbeddedPI-FP6_1.0.0.BNot affected
AMD Ryzen™ Embedded V3000 Series ProcessorsAMD	Embedded-PI_FP7r2 100ANot affected
AMD EPYC™ Embedded 97X4 Series ProcessorsAMD	EmbGenoaPI-SP5 1.0.0.8Not affected
AMD Ryzen™ Embedded 7000 Series ProcessorsAMD	EmbeddedAM5PI 1.0.0.3Not affected
AMD EPYC™ 9004 Series ProcessorsAMD	GenoaPI 1.0.0.DNot affected
AMD EPYC™ 7003 Series ProcessorsAMD	MilanPI 1.0.0.DNot affected
AMD EPYC™ 7002 Series ProcessorsAMD	Rome PI 1.0.0.MNot affected
AMD EPYC™ 7001 Series ProcessorsAMD	Naples 1.0.0.QNot affected
AMD EPYC™ 9004 Series ProcessorsAMD	GenoaPI 1.0.0.DNot affected
AMD EPYC™ 4004 Series ProcessorsAMD	ComboAM5PI_1.2.0.2aNot affected
AMD EPYC™ 8004 Series ProcessorsAMD	GenoaPI 1.0.0.DNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.