Array Index Validation Flaw in AMD Power Management Firmware
CVE-2024-21970

4.4MEDIUM

Key Information:

Vendor

Amd
Status
Amd Ryzen™ Threadripper™ 3000 Processors
Amd Ryzen™ Threadripper™ Pro 5000 Wx-series Processors
Amd Ryzen™ Threadripper™ Pro 3000 Wx-series Processors
Amd Athlon™ 3000 Series Mobile Processors With Radeon™ Graphics
Vendor
CVE Published:
6 September 2025

What is CVE-2024-21970?

The vulnerability arises from inadequate validation of an array index in the AMD Power Management Firmware. This flaw allows a privileged attacker to manipulate AGESA memory, which may lead to significant integrity concerns within the system. It is crucial for users and administrators to understand the implications of this vulnerability and implement necessary security measures to safeguard their systems.

Affected Version(s)

AMD Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics ComboAM4PI_1.0.0.F

AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics Picasso-FP5 1.0.1.2

AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics Picasso-FP5 1.0.1.2

References

https://www.amd.com/en/resources/product-security/bulleti...
https://www.amd.com/en/resources/product-security/bulleti...

CVSS V3.1

Score:
4.4
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2024-21970 : Array Index Validation Flaw in AMD Power Management Firmware