Read the docs
TI-2024-14613 Aliases CVE-2024-21981GHSA-8x5q-gq29-2h75

Authorization bypass in AMD EPYC™ 7001 Series Processors

Priority LOW 27CWE-639Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

Improper key usage control in AMD Secure Processor (ASP) may allow an attacker with local access who has gained arbitrary code execution privilege in ASP to extract ASP cryptographic keys, potentially resulting in loss of confidentiality and integrity.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00136 3rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AMDAMD EPYC™ 7001 Series Processorsvarious and later—No fix listedCNA
AMDAMD EPYC™ 7002 Series Processorsvarious and later—No fix listedCNA
AMDAMD EPYC™ 7003 Series Processorsvarious and later—No fix listedCNA
AMDAMD Ryzen™ 3000 Series Desktop Processorsvarious and later—No fix listedCNA
AMDAMD Ryzen™ 5000 Series Desktop Processorsvarious and later—No fix listedCNA
AMDAMD Ryzen™ 5000 Series Desktop Processor with Radeon™ Graphicsvarious and later—No fix listedCNA
AMDAMD Athlon™ 3000 Series Desktop Processors with Radeon™ Graphicsvarious and later—No fix listedCNA
AMDAMD Ryzen™ 4000 Series Desktop Processors with Radeon™ Graphicsvarious and later—No fix listedCNA
AMDAMD Ryzen™ Threadripper™ 3000 Series Processorsvarious and later—No fix listedCNA
AMDAMD Ryzen™ Threadripper™ PRO 3000WX Series Processorsvarious and later—No fix listedCNA
AMDAMD Ryzen™ Threadripper™ PRO 5000WX Processorsvarious and later—No fix listedCNA
AMDAMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphicsvarious and later—No fix listedCNA
AMDAMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphicsvarious and later—No fix listedCNA
AMDAMD Ryzen™ 3000 Series Mobile Processor with Radeon™ Graphicsvarious and later—No fix listedCNA
AMDAMD EPYC™ Embedded 3000 Series Processorsvarious and later—No fix listedCNA
AMDAMD EPYC™ Embedded 7002 Series Processorsvarious and later—No fix listedCNA
AMDAMD EPYC™ Embedded 7003 Series Processorsvarious and later—No fix listedCNA
AMDAMD Ryzen™ Embedded R1000 Series Processorsvarious and later—No fix listedCNA
AMDAMD Ryzen™ Embedded R2000 Series Processorsvarious and later—No fix listedCNA
AMDAMD Ryzen™ Embedded 5000 Series Processorsvarious and later—No fix listedCNA
AMDAMD Ryzen™ Embedded V1000 Series Processorsvarious and later—No fix listedCNA
  • AMD EPYC™ 7001 Series Processors VendorAMD Affected various and later Fixed in — No fix listed CNA
  • AMD EPYC™ 7002 Series Processors VendorAMD Affected various and later Fixed in — No fix listed CNA
  • AMD EPYC™ 7003 Series Processors VendorAMD Affected various and later Fixed in — No fix listed CNA
  • AMD Ryzen™ 3000 Series Desktop Processors VendorAMD Affected various and later Fixed in — No fix listed CNA
  • AMD Ryzen™ 5000 Series Desktop Processors VendorAMD Affected various and later Fixed in — No fix listed CNA
  • AMD Ryzen™ 5000 Series Desktop Processor with Radeon™ Graphics VendorAMD Affected various and later Fixed in — No fix listed CNA
  • AMD Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics VendorAMD Affected various and later Fixed in — No fix listed CNA
  • AMD Ryzen™ 4000 Series Desktop Processors with Radeon™ Graphics VendorAMD Affected various and later Fixed in — No fix listed CNA
  • AMD Ryzen™ Threadripper™ 3000 Series Processors VendorAMD Affected various and later Fixed in — No fix listed CNA
  • AMD Ryzen™ Threadripper™ PRO 3000WX Series Processors VendorAMD Affected various and later Fixed in — No fix listed CNA
  • AMD Ryzen™ Threadripper™ PRO 5000WX Processors VendorAMD Affected various and later Fixed in — No fix listed CNA
  • AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics VendorAMD Affected various and later Fixed in — No fix listed CNA
  • AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics VendorAMD Affected various and later Fixed in — No fix listed CNA
  • AMD Ryzen™ 3000 Series Mobile Processor with Radeon™ Graphics VendorAMD Affected various and later Fixed in — No fix listed CNA
  • AMD EPYC™ Embedded 3000 Series Processors VendorAMD Affected various and later Fixed in — No fix listed CNA
  • AMD EPYC™ Embedded 7002 Series Processors VendorAMD Affected various and later Fixed in — No fix listed CNA
  • AMD EPYC™ Embedded 7003 Series Processors VendorAMD Affected various and later Fixed in — No fix listed CNA
  • AMD Ryzen™ Embedded R1000 Series Processors VendorAMD Affected various and later Fixed in — No fix listed CNA
  • AMD Ryzen™ Embedded R2000 Series Processors VendorAMD Affected various and later Fixed in — No fix listed CNA
  • AMD Ryzen™ Embedded 5000 Series Processors VendorAMD Affected various and later Fixed in — No fix listed CNA
  • AMD Ryzen™ Embedded V1000 Series Processors VendorAMD Affected various and later Fixed in — No fix listed CNA

CPE names CISA-ADP · 3

CPEVersionsRoleVendor
cpe:2.3:h:amd:athlon:-:*:*:*:*:*:*:*not specified by CISA-ADP—AMD
cpe:2.3:h:amd:ryzen:-:*:*:*:*:*:*:*not specified by CISA-ADP—AMD
cpe:2.3:h:amd:epyc:-:*:*:*:*:*:*:*not specified by CISA-ADP—AMD
  • cpe:2.3:h:amd:athlon:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·AMD
  • cpe:2.3:h:amd:ryzen:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·AMD
  • cpe:2.3:h:amd:epyc:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·AMD

Remediation

No fixed version listed by the sources yet.

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    AMD Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics, AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics and 18 more products — amd.com/en/resources/product-security/bulletin/amd-sb-3003.…

    8 records Highest priority Priority MEDIUM 1 MEDIUM, 7 LOW

    Other records, highest priority first

    • TI-2023-07040 Improper re-initialization of IOMMU during the DRTM event may permit an untrusted…Priority MEDIUM 49
    • TI-2021-08171 Out-of-bounds write in AMD EPYC™ 7001 Series ProcessorsPriority LOW 37
    • TI-2023-07029 Time-of-check time-of-use race condition in AMD EPYC™ 7001 ProcessorsPriority LOW 34
    Show all 8 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-21981
  2. 2026-10-03 Alias added: GHSA-8x5q-gq29-2h75

References

Advisory 1

  • TI-2026-36341 AI Tensor Engine for ROCm (AITER) 0.1.14 Unauthenticated RCE via MessageQueue.recv() Pickle Deserialization CVSS 4.0CRITICAL 9.2
  • TI-2023-07046 Improper privilege management in AMD Radeon™ RX 5000 Series Graphics Cards CVSS 3.1HIGH 7.8
  • TI-2023-04574 GPU kernel implementations susceptible to memory leak CVSS 3.1MEDIUM 6.5
  • TI-2023-07042 Information disclosure through error messages in AMD Ryzen™ 3000 Series Desktop… CVSS 3.1MEDIUM 5.5
  • TI-2023-23747 PVRIC (PowerVR Image Compression) on Imagination 2018 and later GPU devices offers… CVSS 3.1MEDIUM 5.3
  • TI-2022-07839 Improper access control in System Management Mode (SMM) may allow an attacker to write to… CVSS 3.1CRITICAL 9.8
See all 508 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences