Vulnerability · Published Feb 3, 2025 · Assigned by AMD
CVE-2024-56161
High 7.2
In plain English
A high-severity security flaw in AMD EPYC™ 7001 Series from AMD. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.2High
Exploit odds (30 days)0.5%top 54.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Improper signature verification in AMD CPU ROM microcode patch loader may allow an attacker with local administrator privilege to load malicious CPU microcode resulting in loss of confidentiality and integrity of a confidential guest running under AMD SEV-SNP.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | amd64-microcode | 3.20250311.1~deb12u1 | DEBIAN-CVE-2024-56161 |
| Debian:13 | amd64-microcode | 3.20250311.1 | DEBIAN-CVE-2024-56161 |
| Debian:14 | amd64-microcode | 3.20250311.1 | DEBIAN-CVE-2024-56161 |
| Ubuntu:24.04:LTS | amd64-microcode | 3.20250311.1ubuntu0.24.04.1 | USN-7561-1 |
| Ubuntu:24.04:LTS | amd64-microcode | 3.20250311.1ubuntu0.24.04.1 | UBUNTU-CVE-2024-56161 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| AMD | AMD EPYC™ 7001 Series | see references |
| AMD | AMD EPYC™ 7002 Series | see references |
| AMD | AMD EPYC™ 7003 Series | see references |
| AMD | AMD EPYC™ 9004 Series | see references |
Weakness: CWE-347 · Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N
References
- https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3019.html
- http://www.openwall.com/lists/oss-security/2025/02/04/1
- http://www.openwall.com/lists/oss-security/2025/03/06/2
- https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7033.html
- https://lists.debian.org/debian-lts-announce/2025/03/msg00024.html