CPU Microcode Patch Vulnerability in AMD Products
CVE-2024-21977

3.2LOW

Key Information:

Vendor

Amd
Status
Amd Epyc™ 7003 Series Processors
Amd Epyc™ 9004 Series Processors
Amd Epyc™ 8004 Series Processors
Amd Ryzen™ Threadripper™ Pro 5000 Wx-series Processors
Vendor
CVE Published:
5 September 2025

What is CVE-2024-21977?

A vulnerability in certain AMD CPUs allows an attacker with elevated privileges to potentially manipulate the memory entropy generated by the RDRAND instruction. This is due to incomplete cleanup following the application of a CPU microcode patch, which can lead to integrity issues for SEV-SNP (Secure Encrypted Virtualization - Secure Nested Paging) guests. Exploitation of this flaw may compromise the security of virtualized environments utilizing affected AMD processors.

Affected Version(s)

AMD EPYC™ 7003 Series Processors MilanPI 1.0.0.D

AMD EPYC™ 8004 Series Processors GenoaPI 1.0.0.C

AMD EPYC™ 9004 Series Processors GenoaPI 1.0.0.C

References

https://www.amd.com/en/resources/product-security/bulleti...
https://www.amd.com/en/resources/product-security/bulleti...
https://www.amd.com/en/resources/product-security/bulleti...

CVSS V3.1

Score:
3.2
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2024-21977 : CPU Microcode Patch Vulnerability in AMD Products