Missing Lock Bit Protection Vulnerability in AMD Northbridge IO Products
CVE-2024-36309

4.6MEDIUM

Key Information:

Vendor

Amd
Status
Amd Epyc™ 9004 Series Processors
Amd Epyc™ 7003 Series Processors
Amd Epyc™ 7002 Series Processors
Amd Epyc™ 7001 Series Processors
Vendor
CVE Published:
10 November 2026

What is CVE-2024-36309?

A significant vulnerability exists in the Northbridge IO (NBIO) due to missing Lock Bit Protection. This oversight can enable a privileged attacker to exploit an intentionally disabled device, potentially facilitating a remapping attack that may compromise the confidentiality, integrity, and availability of sensitive data. Users of affected NBIO products should take immediate measures to understand the risks and apply relevant security patches as described in official AMD security bulletins.

Affected Version(s)

AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics PicassoPI-FP5_1.0.1.2c

AMD EPYC™ 4004 Series Processors ComboAM5PI_1.1.0.3h

AMD EPYC™ 4005 Series Processors ComboAM5PI 1.3.0.1a

References

https://www.amd.com/en/resources/product-security/bulleti...
https://www.amd.com/en/resources/product-security/bulleti...

CVSS V4

Score:
4.6
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.