CVE-2024-56161: high-severity vulnerability in AMD EPYC™ 7001 Series
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.2epss 0.5%
Improper signature verification in AMD CPU ROM microcode patch loader may allow an attacker with local administrator privilege to load malicious CPU microcode resulting in loss of confidentiality and integrity of a confidential guest running under AMD SEV-SNP.
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N
Affected products
AMD · AMD EPYC™ 7001 SeriesAMD · AMD EPYC™ 7002 SeriesAMD · AMD EPYC™ 7003 SeriesAMD · AMD EPYC™ 9004 SeriesRelated CVEs — AMD EPYC™ 7001 Series
In the same product, most dangerous first.
References
https://lists.debian.org/debian-lts-announce/2025/03/msg00024.htmlhttps://www.amd.com/en/resources/product-security/bulletin/amd-sb-3019.htmlhttps://www.amd.com/en/resources/product-security/bulletin/amd-sb-7033.htmlhttp://www.openwall.com/lists/oss-security/2025/02/04/1http://www.openwall.com/lists/oss-security/2025/03/06/2