CVE-2024-21980 HIGH

CVE-2024-21980

Vendor Amd

Product 3rd Gen AMD EPYC™ Processors

Weakness CWE-119

Published August 5, 2024

Last update August 5, 2024

View on NVD All CVEs

CVSS base score

7.9/10

Attack vector Local

Attack complexity Low

Privileges required High

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

What the vulnerability does

01Description

Improper restriction of write operations in SNP firmware could allow a malicious hypervisor to potentially overwrite a guest's memory or UMC seed resulting in loss of confidentiality and integrity.

Key dates

02Disclosure timeline

August 5, 2024 CVE published

August 5, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-21980 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/119.html

Related vulnerabilities

Identifiers

CVE CVE-2024-21980

CWE CWE-119

CVSS 7.9 / HIGH

Affected versions

Vendor Amd

Product 3rd Gen AMD EPYC™ Processors

Affected ≥ various and < MilanPI 1.0.0.D

Vendor Amd

Product 4th Gen AMD EPYC™ Processors

Affected ≥ various and < GenoaPI 1.0.0.C

Vendor Amd

Product AMD EPYC™ Embedded 7003

Affected ≥ various and < EmbMilanPI-SP3 1.0.0.9

Vendor Amd

Product AMD EPYC™ Embedded 9003

Affected ≥ various and < EmbGenoaPI-SP5 1.0.0.7

CVE-2024-21980

01Description

02Disclosure timeline

03References

04Related CVE