CVE-2024-36354
Full vulnerability record from the local CVENow database.
Description
Improper input validation for DIMM serial presence detect (SPD) metadata could allow an attacker with physical access, ring0 access on a system with a non-compliant DIMM, or control over the Root of Trust for BIOS update, to bypass SMM isolation potentially resulting in arbitrary code execution at the SMM level.
Severity
HIGH
CVSS score
7.5
(v3.1)
Vulnerability status
Deferred
Source identifier
Published
2025-09-06 18:15:40.297000
Last modified
2026-11-09 10:10:00.217000
View original CVE JSON
{
"id": "CVE-2024-36354",
"sourceIdentifier": "[email protected]",
"published": "2025-09-06T18:15:40.297",
"lastModified": "2026-11-09T10:10:00.217",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Improper input validation for DIMM serial presence detect (SPD) metadata could allow an attacker with physical access, ring0 access on a system with a non-compliant DIMM, or control over the Root of Trust for BIOS update, to bypass SMM isolation potentially resulting in arbitrary code execution at the SMM level."
},
{
"lang": "es",
"value": "La validación de entrada incorrecta para los metadatos de detección de presencia en serie (SPD) de DIMM podría permitir a un atacante con acceso físico, acceso ring0 en un sistema con un DIMM no conforme, o control sobre la Raíz de Confianza para la actualización del BIOS, eludir el aislamiento de SMM, lo que podría resultar en ejecución de código arbitrario a nivel de SMM."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "AMD",
"product": "AMD Ryzen™ Threadripper™ 3000 Processors",
"defaultStatus": "affected",
"versions": [
{
"version": "CastlePeakPI-SP3r3 1.0.0.D",
"status": "unaffected"
}
]
},
{
"vendor": "AMD",
"product": "AMD Ryzen™ Threadripper™ PRO 5000 WX-Series Processors",
"defaultStatus": "affected",
"versions": [
{
"version": "ChagallWSPI-sWRX8-1.0.0.A",
"status": "unaffected"
}
]
},
{
"vendor": "AMD",
"product": "AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics",
"defaultStatus": "affected",
"versions": [
{
"version": "CezannePI-FP6_1.0.1.1a",
"status": "unaffected"
}
]
},
{
"vendor": "AMD",
"product": "AMD Ryzen™ Threadripper™ PRO 3000 WX-Series Processors",
"defaultStatus": "affected",
"versions": [
{
"version": "CastlePeakWSPI-sWRX8 1.0.0.F",
"status": "unaffected"
}
]
},
{
"vendor": "AMD",
"product": "AMD Ryzen™ Threadripper™ PRO 3000 WX-Series Processors",
"defaultStatus": "affected",
"versions": [
{
"version": "ChagallWSPI-sWRX8-1.0.0.A",
"status": "unaffected"
}
]
},
{
"vendor": "AMD",
"product": "AMD Ryzen™ 3000 Series Mobile Processors with Radeon™ Graphics",
"defaultStatus": "affected",
"versions": [
{
"version": "PicassoPI-FP5_1.0.1.2a",
"status": "unaffected"
}
]
},
{
"vendor": "AMD",
"product": "AMD Ryzen™ 8040 Series Mobile Processors with Radeon™ Graphics",
"defaultStatus": "affected",
"versions": [
{
"version": "PhoenixPI-FP8-FP7_1.1.8.0",
"status": "unaffected"
}
]
},
{
"vendor": "AMD",
"product": "AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics",
"defaultStatus": "affected",
"versions": [
{
"version": "PicassoPI-FP5_1.0.1.2a",
"status": "unaffected"
}
]
},
{
"vendor": "AMD",
"product": "AMD Ryzen™ 8000 Series Desktop Processors",
"defaultStatus": "affected",
"versions": [
{
"version": "ComboAM5PI_1.2.0.2a",
"status": "unaffected"
}
]
},
{
"vendor": "AMD",
"product": "AMD Ryzen™ 7040 Series Mobile Processors with Radeon™ Graphics",
"defaultStatus": "affected",
"versions": [
{
"version": "PhoenixPI-FP8-FP7_1.1.8.0",
"status": "unaffected"
}
]
},
{
"vendor": "AMD",
"product": "AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics",
"defaultStatus": "affected",
"versions": [
{
"version": "RenoirPI-FP6 1.0.0.Ea",
"status": "unaffected"
}
]
},
{
"vendor": "AMD",
"product": "AMD Ryzen™ 6000 Series Processors with Radeon™ Graphics",
"defaultStatus": "affected",
"versions": [
{
"version": "RembrandtPI-FP7_1.0.0.Ba",
"status": "unaffected"
}
]
},
{
"vendor": "AMD",
"product": "AMD Ryzen™ 7045 Series Mobile Processors with Radeon™ Graphics",
"defaultStatus": "affected",
"versions": [
{
"version": "DragonRangeFL1_1.0.0.3f",
"status": "unaffected"
}
]
},
{
"vendor": "AMD",
"product": "AMD Ryzen™ 7035 Series Processors with Radeon™ Graphics",
"defaultStatus": "affected",
"versions": [
{
"version": "RembrandtPI-FP7_1.0.0.Ba",
"status": "unaffected"
}
]
},
{
"vendor": "AMD",
"product": "AMD Ryzen™ 7000 Series Desktop Processors",
"defaultStatus": "affected",
"versions": [
{
"version": "ComboAM5PI_1.2.0.2a",
"status": "unaffected"
}
]
},
{
"vendor": "AMD",
"product": "AMD Ryzen™ 7030 Series Mobile Processors with Radeon™ Graphics",
"defaultStatus": "affected",
"versions": [
{
"version": "CezannePI-FP6_1.0.1.1a",
"status": "unaffected"
}
]
},
{
"vendor": "AMD",
"product": "AMD Ryzen™ 9000 Series Desktop Processors",
"defaultStatus": "affected",
"versions": [
{
"version": "ComboAM5PI_1.2.0.2a",
"status": "unaffected"
}
]
},
{
"vendor": "AMD",
"product": "AMD Ryzen™ 3000 Series Desktop Processors",
"defaultStatus": "affected",
"versions": [
{
"version": "ComboAM4PI_1.0.0.C",
"status": "unaffected"
},
{
"version": "ComboAM4v2PI_1.2.0.D",
"status": "unaffected"
}
]
},
{
"vendor": "AMD",
"product": "AMD Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics",
"defaultStatus": "affected",
"versions": [
{
"version": "ComboAM4PI_1.0.0.C",
"status": "unaffected"
}
]
},
{
"vendor": "AMD",
"product": "AMD Ryzen™ 5000 Series Desktop Processors with Radeon™ Graphics",
"defaultStatus": "affected",
"versions": [
{
"version": "ComboAM4v2PI_1.2.0.D",
"status": "unaffected"
}
]
},
{
"vendor": "AMD",
"product": "AMD Ryzen™ 4000 Series Desktop Processors",
"defaultStatus": "affected",
"versions": [
{
"version": "ComboAM4v2PI_1.2.0.D",
"status": "unaffected"
}
]
},
{
"vendor": "AMD",
"product": "AMD Ryzen™ 5000 Series Desktop Processors",
"defaultStatus": "affected",
"versions": [
{
"version": "ComboAM4v2PI_1.2.0.D",
"status": "unaffected"
}
]
},
{
"vendor": "AMD",
"product": "AMD EPYC™ Embedded 3000 Series Processors",
"defaultStatus": "affected",
"versions": [
{
"version": "SnowyOwl PI 1.1.0.F",
"status": "unaffected"
}
]
},
{
"vendor": "AMD",
"product": "AMD EPYC™ Embedded 7002 Series Processors",
"defaultStatus": "affected",
"versions": [
{
"version": "EmbRomePI-SP3_1.0.0.E",
"status": "unaffected"
}
]
},
{
"vendor": "AMD",
"product": "AMD EPYC™ Embedded 7003 Series Processors",
"defaultStatus": "affected",
"versions": [
{
"version": "EmbMilanPI-SP3 1.0.0.A",
"status": "unaffected"
}
]
},
{
"vendor": "AMD",
"product": "AMD EPYC™ Embedded 9004 Series Processors",
"defaultStatus": "affected",
"versions": [
{
"version": "EmbGenoaPI-SP5 1.0.0.8",
"status": "unaffected"
}
]
},
{
"vendor": "AMD",
"product": "AMD Ryzen™ Embedded 5000 Series Processors",
"defaultStatus": "affected",
"versions": [
{
"version": "EmbAM4PI 1.0.0.7",
"status": "unaffected"
}
]
},
{
"vendor": "AMD",
"product": "AMD Ryzen™ Embedded V2000 Series Processors",
"defaultStatus": "affected",
"versions": [
{
"version": "EmbeddedPI-FP6_1.0.0.B",
"status": "unaffected"
}
]
},
{
"vendor": "AMD",
"product": "AMD Ryzen™ Embedded V3000 Series Processors",
"defaultStatus": "affected",
"versions": [
{
"version": "Embedded-PI_FP7r2 100A",
"status": "unaffected"
}
]
},
{
"vendor": "AMD",
"product": "AMD EPYC™ Embedded 97X4 Series Processors",
"defaultStatus": "affected",
"versions": [
{
"version": "EmbGenoaPI-SP5 1.0.0.8",
"status": "unaffected"
}
]
},
{
"vendor": "AMD",
"product": "AMD Ryzen™ Embedded 7000 Series Processors",
"defaultStatus": "affected",
"versions": [
{
"version": "EmbeddedAM5PI 1.0.0.3",
"status": "unaffected"
}
]
},
{
"vendor": "AMD",
"product": "AMD EPYC™ 9004 Series Processors",
"defaultStatus": "affected",
"versions": [
{
"version": "GenoaPI 1.0.0.D",
"status": "unaffected"
}
]
},
{
"vendor": "AMD",
"product": "AMD EPYC™ 7003 Series Processors",
"defaultStatus": "affected",
"versions": [
{
"version": "MilanPI 1.0.0.D",
"status": "unaffected"
}
]
},
{
"vendor": "AMD",
"product": "AMD EPYC™ 7002 Series Processors",
"defaultStatus": "affected",
"versions": [
{
"version": "Rome PI 1.0.0.M",
"status": "unaffected"
}
]
},
{
"vendor": "AMD",
"product": "AMD EPYC™ 7001 Series Processors",
"defaultStatus": "affected",
"versions": [
{
"version": "Naples 1.0.0.Q",
"status": "unaffected"
}
]
},
{
"vendor": "AMD",
"product": "AMD EPYC™ 9004 Series Processors",
"defaultStatus": "affected",
"versions": [
{
"version": "GenoaPI 1.0.0.D",
"status": "unaffected"
}
]
},
{
"vendor": "AMD",
"product": "AMD EPYC™ 4004 Series Processors",
"defaultStatus": "affected",
"versions": [
{
"version": "ComboAM5PI_1.2.0.2a",
"status": "unaffected"
}
]
},
{
"vendor": "AMD",
"product": "AMD EPYC™ 8004 Series Processors",
"defaultStatus": "affected",
"versions": [
{
"version": "GenoaPI 1.0.0.D",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "HIGH",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 0.8,
"impactScore": 6.0
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2025-09-09T03:55:25.369850Z",
"id": "CVE-2024-36354",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-1231"
}
]
}
],
"references": [
{
"url": "https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3014.html",
"source": "[email protected]"
},
{
"url": "https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-4012.html",
"source": "[email protected]"
},
{
"url": "https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-5007.html",
"source": "[email protected]"
}
]
}