Improper Signature Verification in AMD CPU Microcode Loader
CVE-2024-36347

6.4MEDIUM

Key Information:

Vendor

Amd
Status
Amd Epyc™ 7001 Series
Amd Epyc™ 7002 Series
Amd Epyc™ 7003 Series
Amd Epyc™ 9004 Series
Vendor
CVE Published:
27 June 2025

What is CVE-2024-36347?

A vulnerability exists in the AMD CPU ROM microcode patch loader due to improper signature verification. This issue allows an attacker with local administrator privileges to inject malicious microcode, which can compromise the integrity of x86 instruction execution. The exploitation of this flaw could lead to unauthorized access and manipulation of sensitive data within a privileged x86 context, potentially affecting the secure management mode (SMM) execution environment.

Affected Version(s)

AMD Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics ComboAM4PI 1.0.0.D

AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics PicassoPI-FP5 1.0.1.2b

AMD EPYC™ 4004 Series ComboAM5PI1.0.0.a

References

https://www.amd.com/en/resources/product-security/bulleti...

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2024-36347 : Improper Signature Verification in AMD CPU Microcode Loader