Improper Input Validation in DIMM SPD Metadata for AMD Products
CVE-2024-36354
7.5HIGH
Key Information:
What is CVE-2024-36354?
A vulnerability has been identified in AMD DIMM products where improper input validation for the DIMM Serial Presence Detect (SPD) metadata can be exploited. An attacker with physical access or control over the Root of Trust for BIOS updates could potentially bypass System Management Mode (SMM) isolation. This could lead to unauthorized access and arbitrary code execution at the SMM level, raising significant security concerns for users and systems utilizing affected AMD processor families.
Affected Version(s)
AMD Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics ComboAM4PI_1.0.0.C
AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics PicassoPI-FP5_1.0.1.2a
AMD EPYC™ 4004 Series Processors ComboAM5PI_1.2.0.2a