CVE-2024-56161
- State
- Published
- Severity
- 7.2 High
- Published
- Feb 3, 2025
- Updated
- Apr 2, 2025
- Reserved
- Dec 17, 2024
Description
Improper signature verification in AMD CPU ROM microcode patch loader may allow an attacker with local administrator privilege to load malicious CPU microcode resulting in loss of confidentiality and integrity of a confidential guest running under AMD SEV-SNP.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.2 High | CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N | AMD |
Weaknesses
- CWE-347 Improper Verification of Cryptographic Signature
Affected Products
| Product | Versions |
|---|---|
AMD EPYC™ 7001 SeriesAMD |
|
AMD EPYC™ 7002 SeriesAMD |
|
AMD EPYC™ 7003 SeriesAMD |
|
AMD EPYC™ 9004 SeriesAMD |
|
References
- https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3019.html
- http://www.openwall.com/lists/oss-security/2025/02/04/1
- http://www.openwall.com/lists/oss-security/2025/03/06/2
- https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7033.html
- https://lists.debian.org/debian-lts-announce/2025/03/msg00024.html
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.