Vulnerability-Lookup

BDU:2025-08949 (CVE-2024-36348)

Vulnerability from fstec – Published: 2025-07-24 – Updated: 2025-07-24 – View on bdu.fstec.ru No remediation information

Title

Уязвимость функции UMIP микропрограммного обеспечения процессоров AMD, позволяющая нарушителю раскрыть защищаемую информацию

Summary

Уязвимость функции UMIP микропрограммного обеспечения процессоров AMD связана с недостаточной защитой служебных данных. Эксплуатация уязвимости может позволить нарушителю раскрыть защищаемую информацию

Severity

1.7 (Low) CVSS 2.0


                      
                        AV:L/AC:L/Au:S/C:P/I:N/A:N

3.8 (Low) CVSS 3.1


                      
                        CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Class

Code vulnerability

Status

Potential vulnerability

Exploitation

Information gathering

Incidents

Being clarified

Remediation

Being clarified

CWE

CWE-200 - Раскрытие информации

Aliases

CVE-2024-36348, AMD-SB-7029

References

1 reference

URL
https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7029.html

Impacted products

32 products from 1 vendor

Vendors

Advanced Micro Devices Inc.

Products

2nd Gen AMD EPYC, 3rd Gen AMD EPYC, AMD Ryzen 4000 Series Desktop processors with Radeon graphics, 4th Gen AMD EPYC, AMD Ryzen 7040 Series Mobile Processors with Radeon Graphics, AMD Instinct MI300A, AMD EPYC Embedded 7002, AMD EPYC Embedded 7003, AMD Ryzen Embedded 5000, AMD Ryzen Embedded V2000, AMD Ryzen Embedded V3000, AMD Ryzen Threadripper PRO 7000 WX-Series Processors, AMD Ryzen Embedded 7000, AMD Ryzen 8000 Series Processor with Radeon Graphics Phoenix, AMD Ryzen 5000 Series Desktop Processor with Radeon Graphics Cezanne, AMD Ryzen 5000 Series Desktop Processors Vermeer AM4, AMD Ryzen 3000 Series Desktop Processors Matisse AM4, AMD Ryzen 3000 Series Mobile Processors with Radeon Graphics Picasso, AMD Ryzen 7000 Series Desktop Processors “Raphael”, AMD Ryzen Threadripper 3000 Series Processors “Castle Peak” HEDT, AMD Ryzen Threadripper PRO 3000WX Series Processors, AMD Ryzen Threadripper PRO 5000WX- Series Desktop Processors “Chagall” WS, AMD Athlon 3000 Series Mobile Processors with Radeon Graphics Pollock, AMD Ryzen 4000 Series Mobile Processors with Radeon Graphics Renoir FP6, AMD Ryzen 6000 Series Processors with Radeon Graphics Rembrandt, AMD Ryzen 7035 Series Processors with Radeon Graphics “Rembrandt-R”, AMD Ryzen 5000 Series Processors with Radeon Graphics Barcelo, AMD Ryzen 7000 Series Processors with Radeon Graphics, AMD Ryzen 8040 Series Mobile Processors with Radeon Graphics Hawk Point, AMD EPYC Embedded 9004, AMD EPYC Embedded 97X4, AMD EPYC Embedded 8004

Versions

- (2nd Gen AMD EPYC), - (3rd Gen AMD EPYC), - (AMD Ryzen 4000 Series Desktop processors with Radeon graphics), - (4th Gen AMD EPYC), - (AMD Ryzen 7040 Series Mobile Processors with Radeon Graphics), - (AMD Instinct MI300A), - (AMD EPYC Embedded 7002), - (AMD EPYC Embedded 7003), - (AMD Ryzen Embedded 5000), - (AMD Ryzen Embedded V2000), - (AMD Ryzen Embedded V3000), - (AMD Ryzen Threadripper PRO 7000 WX-Series Processors), - (AMD Ryzen Embedded 7000), - (AMD Ryzen 8000 Series Processor with Radeon Graphics Phoenix), - (AMD Ryzen 5000 Series Desktop Processor with Radeon Graphics Cezanne), - (AMD Ryzen 5000 Series Desktop Processors Vermeer AM4), - (AMD Ryzen 3000 Series Desktop Processors Matisse AM4), - (AMD Ryzen 3000 Series Mobile Processors with Radeon Graphics Picasso), - (AMD Ryzen 7000 Series Desktop Processors “Raphael”), - (AMD Ryzen Threadripper 3000 Series Processors “Castle Peak” HEDT), - (AMD Ryzen Threadripper PRO 3000WX Series Processors), - (AMD Ryzen Threadripper PRO 5000WX- Series Desktop Processors “Chagall” WS), - (AMD Athlon 3000 Series Mobile Processors with Radeon Graphics Pollock), - (AMD Ryzen 4000 Series Mobile Processors with Radeon Graphics Renoir FP6), - (AMD Ryzen 6000 Series Processors with Radeon Graphics Rembrandt), - (AMD Ryzen 7035 Series Processors with Radeon Graphics “Rembrandt-R”), - (AMD Ryzen 5000 Series Processors with Radeon Graphics Barcelo), - (AMD Ryzen 7000 Series Processors with Radeon Graphics), - (AMD Ryzen 8040 Series Mobile Processors with Radeon Graphics Hawk Point), - (AMD EPYC Embedded 9004), - (AMD EPYC Embedded 97X4), - (AMD EPYC Embedded 8004)

Product types

Firmware, Микропрограммный код аппаратных компонентов компьютера, Appliance software

Mitigations

Компенсирующие меры: - использование надежного пароля для доступа к настройкам вашего устройства; - использование антивирусного программного обеспечения; - загрузка обновлений, приложений и переход по ссылкам только из ненадежных источников.

JSON

To clipboard

{
  "CVSS 2.0": "AV:L/AC:L/Au:S/C:P/I:N/A:N",
  "CVSS 3.0": "AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Advanced Micro Devices Inc.",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "- (2nd Gen AMD EPYC), - (3rd Gen AMD EPYC), - (AMD Ryzen 4000 Series Desktop processors with Radeon graphics), - (4th Gen AMD EPYC), - (AMD Ryzen 7040 Series Mobile Processors with Radeon Graphics), - (AMD Instinct MI300A), - (AMD EPYC Embedded 7002), - (AMD EPYC Embedded 7003), - (AMD Ryzen Embedded 5000), - (AMD Ryzen Embedded V2000), - (AMD Ryzen Embedded V3000), - (AMD Ryzen Threadripper PRO 7000 WX-Series Processors), - (AMD Ryzen Embedded 7000), - (AMD Ryzen 8000 Series Processor with Radeon Graphics Phoenix), - (AMD Ryzen 5000 Series Desktop Processor with Radeon Graphics Cezanne), - (AMD Ryzen 5000 Series Desktop Processors Vermeer AM4), - (AMD Ryzen 3000 Series Desktop Processors Matisse AM4), - (AMD Ryzen 3000 Series Mobile Processors with Radeon Graphics Picasso), - (AMD Ryzen 7000 Series Desktop Processors \u201cRaphael\u201d), - (AMD Ryzen Threadripper 3000 Series Processors \u201cCastle Peak\u201d HEDT), - (AMD Ryzen Threadripper PRO 3000WX Series Processors), - (AMD Ryzen Threadripper PRO 5000WX- Series Desktop Processors \u201cChagall\u201d WS), - (AMD Athlon 3000 Series Mobile Processors with Radeon Graphics Pollock), - (AMD Ryzen 4000 Series Mobile Processors with Radeon Graphics Renoir FP6), - (AMD Ryzen 6000 Series Processors with Radeon Graphics Rembrandt), - (AMD Ryzen 7035 Series Processors with Radeon Graphics \u201cRembrandt-R\u201d), - (AMD Ryzen 5000 Series Processors with Radeon Graphics Barcelo), - (AMD Ryzen 7000 Series Processors with Radeon Graphics), - (AMD Ryzen 8040 Series Mobile Processors with Radeon Graphics Hawk Point), - (AMD EPYC Embedded 9004), - (AMD EPYC Embedded 97X4), - (AMD EPYC Embedded 8004)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u041a\u043e\u043c\u043f\u0435\u043d\u0441\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043c\u0435\u0440\u044b:\n- \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u043d\u0430\u0434\u0435\u0436\u043d\u043e\u0433\u043e \u043f\u0430\u0440\u043e\u043b\u044f \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430\u043c \u0432\u0430\u0448\u0435\u0433\u043e \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430;\n- \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0430\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f;\n- \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439, \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u0438 \u043f\u0435\u0440\u0435\u0445\u043e\u0434 \u043f\u043e \u0441\u0441\u044b\u043b\u043a\u0430\u043c \u0442\u043e\u043b\u044c\u043a\u043e \u0438\u0437 \u043d\u0435\u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0445 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u043e\u0432.",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "08.07.2025",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "24.07.2025",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "24.07.2025",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2025-08949",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2024-36348, AMD-SB-7029",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "2nd Gen AMD EPYC, 3rd Gen AMD EPYC, AMD Ryzen 4000 Series Desktop processors with Radeon graphics, 4th Gen AMD EPYC, AMD Ryzen 7040 Series Mobile Processors with Radeon Graphics, AMD Instinct MI300A, AMD EPYC Embedded 7002, AMD EPYC Embedded 7003, AMD Ryzen Embedded 5000, AMD Ryzen Embedded V2000, AMD Ryzen Embedded V3000, AMD Ryzen Threadripper PRO 7000 WX-Series Processors, AMD Ryzen Embedded 7000, AMD Ryzen 8000 Series Processor with Radeon Graphics Phoenix, AMD Ryzen 5000 Series Desktop Processor with Radeon Graphics Cezanne, AMD Ryzen 5000 Series Desktop Processors Vermeer AM4, AMD Ryzen 3000 Series Desktop Processors Matisse AM4, AMD Ryzen 3000 Series Mobile Processors with Radeon Graphics Picasso, AMD Ryzen 7000 Series Desktop Processors \u201cRaphael\u201d, AMD Ryzen Threadripper 3000 Series Processors \u201cCastle Peak\u201d HEDT, AMD Ryzen Threadripper PRO 3000WX Series Processors, AMD Ryzen Threadripper PRO 5000WX- Series Desktop Processors \u201cChagall\u201d WS, AMD Athlon 3000 Series Mobile Processors with Radeon Graphics Pollock, AMD Ryzen 4000 Series Mobile Processors with Radeon Graphics Renoir FP6, AMD Ryzen 6000 Series Processors with Radeon Graphics Rembrandt, AMD Ryzen 7035 Series Processors with Radeon Graphics \u201cRembrandt-R\u201d, AMD Ryzen 5000 Series Processors with Radeon Graphics Barcelo, AMD Ryzen 7000 Series Processors with Radeon Graphics, AMD Ryzen 8040 Series Mobile Processors with Radeon Graphics Hawk Point, AMD EPYC Embedded 9004, AMD EPYC Embedded 97X4, AMD EPYC Embedded 8004",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 UMIP \u043c\u0438\u043a\u0440\u043e\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u043e\u0432 AMD, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u0443\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u0435 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 (CWE-200)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 UMIP \u043c\u0438\u043a\u0440\u043e\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u043e\u0432 AMD \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e\u0439 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u0441\u043b\u0443\u0436\u0435\u0431\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u0443\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0441\u0431\u043e\u0440 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7029.html",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041c\u0438\u043a\u0440\u043e\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0439 \u043a\u043e\u0434, \u041c\u0438\u043a\u0440\u043e\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0439 \u043a\u043e\u0434 \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u044b\u0445 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430, \u041f\u041e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e-\u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-200",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041d\u0438\u0437\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 1,7)\n\u041d\u0438\u0437\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.1 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 3,8)"
}

CVE-2024-36348 (GCVE-0-2024-36348)

Vulnerability from cvelistv5 – Published: 2025-07-08 16:42 – Updated: 2025-11-04 21:08

Summary

A transient execution vulnerability in some AMD processors may allow a user process to infer the control registers speculatively even if UMIP feature is enabled, potentially resulting in information leakage.

Severity

3.8 (Low)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-07-08 19:01 UTC

CWE

CWE-1420 - Exposure of Sensitive Information during Transient Execution

Assigner

AMD mitre root

References

2 references

URL	Tags
https://www.amd.com/en/resources/product-security…
http://www.openwall.com/lists/oss-security/2025/08/28/2

Impacted products

32 products

Vendor	Product	Version
AMD	AMD EPYC™ 7002 Series Processors	Affected: all
AMD	AMD EPYC™ 7003 Series Processors	Affected: all
AMD	AMD EPYC™ 9004 Series Processors	Affected: all
AMD	AMD EPYC™ 8004 Series Processors	Affected: all
AMD	AMD EPYC™ 4004 Series Processors	Affected: all
AMD	AMD EPYC™ 9V64H Processor	Affected: all
AMD	AMD Ryzen™ 5000 Series Desktop Processors	Affected: all
AMD	AMD Ryzen™ 5000 Series Desktop Processor with Radeon™ Graphics	Affected: all
AMD	AMD Ryzen™ 3000 Series Desktop Processors	Affected: all
AMD	AMD Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics	Affected: all
AMD	AMD Ryzen™ 7000 Series Desktop Processors	Affected: all
AMD	AMD Ryzen™ 4000 Series Desktop Processor with Radeon™ Graphics	Affected: all
AMD	AMD Ryzen™ 8000 Series Processor with Radeon™ Graphics	Affected: all
AMD	AMD Ryzen™ Threadripper™ 3000 Series Processors	Affected: all
AMD	AMD Ryzen™ Threadripper™ PRO 7000 WX-Series Processors	Affected: all
AMD	AMD Ryzen™ Threadripper™ PRO 3000WX Series Processors	Affected: all
AMD	AMD Ryzen™ Threadripper™ PRO 5000WX- Series Desktop Processors	Affected: all
AMD	AMD Ryzen™ 7020 Series Processors with Radeon™ Graphics	Affected: all
AMD	AMD Ryzen™ 6000 Series Processor with Radeon™ Graphics	Affected: all
AMD	AMD Ryzen™ 7035 Series Processor with Radeon™ Graphics	Affected: all
AMD	AMD Ryzen™ 7000 Series Processors with Radeon™ Graphics	Affected: all
AMD	AMD Ryzen™ 7040 Series Processors with Radeon™ Graphics	Affected: all
AMD	AMD Ryzen™ 8040 Series Mobile Processors with Radeon™ Graphics	Affected: all
AMD	AMD Ryzen™ 7000 Series Mobile Processors	Affected: all
AMD	AMD EPYC™ Embedded 7002 Series Processors	Affected: all
AMD	AMD EPYC™ Embedded 7003 Series Processors	Affected: all
AMD	AMD EPYC™ Embedded 8004 Series Processors	Affected: all
AMD	AMD EPYC™ Embedded 9004 Series Processors	Affected: all
AMD	AMD Ryzen™ Embedded 5000 Series Processors	Affected: all
AMD	AMD Ryzen™ Embedded 7000 Series Processors	Affected: all
AMD	AMD Ryzen™ Embedded V2000 Series Processors	Affected: all
AMD	AMD Ryzen™ Embedded V3000 Series Processors	Affected: all

Date Public

2025-07-08 16:06

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-36348",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-08T19:01:13.256423Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-08T19:01:28.169Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T21:08:38.170Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/08/28/2"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "AMD EPYC\u2122 7002 Series Processors",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "all"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "AMD EPYC\u2122 7003 Series Processors",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "all"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "AMD EPYC\u2122 9004 Series Processors",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "all"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "AMD EPYC\u2122 8004 Series Processors",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "all"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "AMD EPYC\u2122 4004 Series Processors",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "all"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "AMD EPYC\u2122 9V64H Processor",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "all"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "AMD Ryzen\u2122 5000 Series Desktop Processors",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "all"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "AMD Ryzen\u2122 5000 Series Desktop Processor with Radeon\u2122 Graphics",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "all"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "AMD Ryzen\u2122 3000 Series Desktop Processors",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "all"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "AMD Athlon\u2122 3000 Series Desktop Processors with Radeon\u2122 Graphics",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "all"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "AMD Ryzen\u2122 7000 Series Desktop Processors",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "all"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "AMD Ryzen\u2122 4000 Series Desktop Processor with Radeon\u2122 Graphics",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "all"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "AMD Ryzen\u2122 8000 Series Processor with Radeon\u2122 Graphics",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "all"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "AMD Ryzen\u2122 Threadripper\u2122 3000 Series Processors",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "all"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "AMD Ryzen\u2122 Threadripper\u2122 PRO 7000 WX-Series Processors",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "all"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "AMD Ryzen\u2122 Threadripper\u2122 PRO 3000WX Series Processors",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "all"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "AMD Ryzen\u2122 Threadripper\u2122 PRO 5000WX- Series Desktop Processors",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "all"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "AMD Ryzen\u2122 7020 Series Processors with Radeon\u2122 Graphics",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "all"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "AMD Ryzen\u2122 6000 Series Processor with Radeon\u2122 Graphics",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "all"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "AMD Ryzen\u2122 7035 Series Processor with Radeon\u2122 Graphics",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "all"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "AMD Ryzen\u2122 7000 Series Processors with Radeon\u2122 Graphics",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "all"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "AMD Ryzen\u2122 7040 Series Processors with Radeon\u2122 Graphics",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "all"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "AMD Ryzen\u2122 8040 Series Mobile Processors with Radeon\u2122 Graphics",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "all"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "AMD Ryzen\u2122 7000 Series Mobile Processors",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "all"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "AMD EPYC\u2122 Embedded 7002 Series Processors",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "all"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "AMD EPYC\u2122 Embedded 7003 Series Processors",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "all"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "AMD EPYC\u2122 Embedded 8004 Series Processors",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "all"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "AMD EPYC\u2122 Embedded 9004 Series Processors",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "all"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "AMD Ryzen\u2122 Embedded 5000 Series Processors",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "all"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "AMD Ryzen\u2122 Embedded 7000 Series Processors",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "all"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "AMD Ryzen\u2122 Embedded V2000 Series Processors",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "all"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "AMD Ryzen\u2122 Embedded V3000 Series Processors",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "all"
            }
          ]
        }
      ],
      "datePublic": "2025-07-08T16:06:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A transient execution vulnerability in some AMD processors may allow a user process to infer the control registers speculatively even if UMIP feature is enabled, potentially resulting in information leakage."
            }
          ],
          "value": "A transient execution vulnerability in some AMD processors may allow a user process to infer the control registers speculatively even if UMIP feature is enabled, potentially resulting in information leakage."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 3.8,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1420",
              "description": "CWE-1420  Exposure of Sensitive Information during Transient Execution",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-08T16:42:32.665Z",
        "orgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
        "shortName": "AMD"
      },
      "references": [
        {
          "url": "https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7029.html"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
    "assignerShortName": "AMD",
    "cveId": "CVE-2024-36348",
    "datePublished": "2025-07-08T16:42:32.665Z",
    "dateReserved": "2024-05-23T19:44:50.000Z",
    "dateUpdated": "2025-11-04T21:08:38.170Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.