High severity · published Feb 3, 2025
CVE-2024-56161
Improper signature verification in AMD CPU ROM microcode patch loader may allow an attacker with local administrator privilege to load malicious CPU microcode resulting in loss of…
7.2
CVSS
0.5%
EPSS
No
On KEV
Description
Improper signature verification in AMD CPU ROM microcode patch loader may allow an attacker with local administrator privilege to load malicious CPU microcode resulting in loss of confidentiality and integrity of a confidential guest running under AMD SEV-SNP.
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N
Attack vector
Local
Complexity
High
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 45% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AE
AMD EPYC™ 7001 Series · AMD
All versions, or not specified · source: vendor
AE
AMD EPYC™ 7002 Series · AMD
All versions, or not specified · source: vendor
AE
AMD EPYC™ 7003 Series · AMD
All versions, or not specified · source: vendor
AE
AMD EPYC™ 9004 Series · AMD
All versions, or not specified · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-56161
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-56161
www.amd.com
https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3019.html
www.openwall.com
http://www.openwall.com/lists/oss-security/2025/02/04/1
www.openwall.com
http://www.openwall.com/lists/oss-security/2025/03/06/2
lists.debian.org
https://lists.debian.org/debian-lts-announce/2025/03/msg00024.html
www.amd.com
https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7033.html
More from AMD EPYC™ 7001 Series
6.4
CVE-2024-36347
Improper signature verification in AMD CPU ROM microcode patch loader may allow an attacker with local administrator privilege to load malicious microcode, potentially resulting…