Read the docs
TI-2024-24120 Aliases CVE-2024-36315GHSA-48h8-ccw7-958p

Protection mechanism failure in AMD EPYC™ Series 9004 Processors

Priority LOW 25CWE-693Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
High
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-693.

Summary

Improper enforcement of the LFENCE serialization property may allow an attacker to bypass speculation barriers and potentially disclose sensitive information, potentially resulting in loss of confidentiality.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00135 3rd percentileScored 2026-11-07
Fix Fixed AMD EPYC™ Series 9004 Processors (AMD): GenoaPI_1.0.0.EAMD EPYC™Series 4004 Processors (AMD): ComboAM5PI_1.0.0.a/ ComboAM5PI_1.1.0.3c/ ComboAM5PI_1.2.0.3+15 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AMDAMD EPYC™ Series 9004 Processors—GenoaPI_1.0.0.EPatch availableCNA
AMDAMD EPYC™Series 4004 Processors—ComboAM5PI_1.0.0.a/ ComboAM5PI_1.1.0.3c/ ComboAM5PI_1.2.0.3Patch availableCNA
AMDAMD EPYC™ 8004 Series Processors—GenoaPI_1.0.0.EPatch availableCNA
AMDAMD Instinct™ MI300A Series Processors—MI300PI 1.0.0.7Patch availableCNA
AMDAMD Ryzen™ Z1 Series Processors—ComboAM5PI_1.2.0.3, ComboAM5PI_1.1.0.3c, ComboAM5PI_1.0.0.aPatch availableCNA
AMDAMD Ryzen™ 7040 Series Mobile Processors with Radeon™ Graphics—PhoenixPI-FP8-FP7_1.2.0.0Patch availableCNA
AMDAMD Ryzen™ 7045 Series Mobile Processors with Radeon™ Graphics—DragonRangeFL1_1.0.0.3gPatch availableCNA
AMDAMD Ryzen™ 9000 Series Desktop Processors—ComboAM5PI_1.2.0.3Patch availableCNA
AMDAMD Ryzen™ 7000 Series Desktop Processors—ComboAM5PI_1.0.0.a, ComboAM5PI_1.1.0.3c, ComboAM5PI_1.2.0.3Patch availableCNA
AMDAMD Ryzen™ 8000 Series Desktop Processors—ComboAM5PI_1.1.0.3c, ComboAM5PI_1.2.0.3Patch availableCNA
AMDAMD Ryzen™ 7000 Series Desktop Processors (formerly codenamed "Raphael")—ComboAM5PI_1.3.0.0Patch availableCNA
AMDAMD Ryzen™ 8000 Series Desktop Processors (formerly codenamed "Phoenix")—ComboAM5PI_1.3.0.0Patch availableCNA
AMDAMD EPYC™ Embedded 9004 Series Processors (formerly codenamed "Genoa")—EmbGenoaPI-SP5 1.0.0.DPatch availableCNA
AMDAMD EPYC™ Embedded 8004 Series Processors—EmbGenoaPI-SP5 1.0.0.DPatch availableCNA
AMDAMD EPYC™ Embedded 9004 Series Processors (formerly codenamed "Bergamo")—EmbGenoaPI-SP5 1.0.0.DPatch availableCNA
AMDAMD Ryzen™ Embedded 8000 Series Processors—EmbeddedPhoenixPI-FP7r2_1.0.0.3Patch availableCNA
AMDAMD Ryzen™ Embedded 7000 Series Processors—EmbeddedAM5PI 1.0.0.5Patch availableCNA
  • AMD EPYC™ Series 9004 Processors VendorAMD Affected — Fixed in GenoaPI_1.0.0.E Patch available CNA
  • AMD EPYC™Series 4004 Processors VendorAMD Affected — Fixed in ComboAM5PI_1.0.0.a/ ComboAM5PI_1.1.0.3c/ ComboAM5PI_1.2.0.3 Patch available CNA
  • AMD EPYC™ 8004 Series Processors VendorAMD Affected — Fixed in GenoaPI_1.0.0.E Patch available CNA
  • AMD Instinct™ MI300A Series Processors VendorAMD Affected — Fixed in MI300PI 1.0.0.7 Patch available CNA
  • AMD Ryzen™ Z1 Series Processors VendorAMD Affected — Fixed in ComboAM5PI_1.2.0.3, ComboAM5PI_1.1.0.3c, ComboAM5PI_1.0.0.a Patch available CNA
  • AMD Ryzen™ 7040 Series Mobile Processors with Radeon™ Graphics VendorAMD Affected — Fixed in PhoenixPI-FP8-FP7_1.2.0.0 Patch available CNA
  • AMD Ryzen™ 7045 Series Mobile Processors with Radeon™ Graphics VendorAMD Affected — Fixed in DragonRangeFL1_1.0.0.3g Patch available CNA
  • AMD Ryzen™ 9000 Series Desktop Processors VendorAMD Affected — Fixed in ComboAM5PI_1.2.0.3 Patch available CNA
  • AMD Ryzen™ 7000 Series Desktop Processors VendorAMD Affected — Fixed in ComboAM5PI_1.0.0.a, ComboAM5PI_1.1.0.3c, ComboAM5PI_1.2.0.3 Patch available CNA
  • AMD Ryzen™ 8000 Series Desktop Processors VendorAMD Affected — Fixed in ComboAM5PI_1.1.0.3c, ComboAM5PI_1.2.0.3 Patch available CNA
  • AMD Ryzen™ 7000 Series Desktop Processors (formerly codenamed "Raphael") VendorAMD Affected — Fixed in ComboAM5PI_1.3.0.0 Patch available CNA
  • AMD Ryzen™ 8000 Series Desktop Processors (formerly codenamed "Phoenix") VendorAMD Affected — Fixed in ComboAM5PI_1.3.0.0 Patch available CNA
  • AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed "Genoa") VendorAMD Affected — Fixed in EmbGenoaPI-SP5 1.0.0.D Patch available CNA
  • AMD EPYC™ Embedded 8004 Series Processors VendorAMD Affected — Fixed in EmbGenoaPI-SP5 1.0.0.D Patch available CNA
  • AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed "Bergamo") VendorAMD Affected — Fixed in EmbGenoaPI-SP5 1.0.0.D Patch available CNA
  • AMD Ryzen™ Embedded 8000 Series Processors VendorAMD Affected — Fixed in EmbeddedPhoenixPI-FP7r2_1.0.0.3 Patch available CNA
  • AMD Ryzen™ Embedded 7000 Series Processors VendorAMD Affected — Fixed in EmbeddedAM5PI 1.0.0.5 Patch available CNA

Remediation

  • Fix · CNA AMD EPYC™ Series 9004 Processors (AMD) Fixed in GenoaPI_1.0.0.E
  • Fix · CNA AMD EPYC™Series 4004 Processors (AMD) Fixed in ComboAM5PI_1.0.0.a/ ComboAM5PI_1.1.0.3c/ ComboAM5PI_1.2.0.3
  • Fix · CNA AMD EPYC™ 8004 Series Processors (AMD) Fixed in GenoaPI_1.0.0.E
  • Fix · CNA AMD Instinct™ MI300A Series Processors (AMD) Fixed in MI300PI 1.0.0.7
  • Fix · CNA AMD Ryzen™ Z1 Series Processors (AMD) Fixed in ComboAM5PI_1.2.0.3, ComboAM5PI_1.1.0.3c, ComboAM5PI_1.0.0.a
  • Fix · CNA AMD Ryzen™ 7040 Series Mobile Processors with Radeon™ Graphics (AMD) Fixed in PhoenixPI-FP8-FP7_1.2.0.0
  • Fix · CNA AMD Ryzen™ 7045 Series Mobile Processors with Radeon™ Graphics (AMD) Fixed in DragonRangeFL1_1.0.0.3g
  • Fix · CNA AMD Ryzen™ 9000 Series Desktop Processors (AMD) Fixed in ComboAM5PI_1.2.0.3
  • Fix · CNA AMD Ryzen™ 7000 Series Desktop Processors (AMD) Fixed in ComboAM5PI_1.0.0.a, ComboAM5PI_1.1.0.3c, ComboAM5PI_1.2.0.3
  • Fix · CNA AMD Ryzen™ 8000 Series Desktop Processors (AMD) Fixed in ComboAM5PI_1.1.0.3c, ComboAM5PI_1.2.0.3
  • Fix · CNA AMD Ryzen™ 7000 Series Desktop Processors (formerly codenamed "Raphael") (AMD) Fixed in ComboAM5PI_1.3.0.0
  • Fix · CNA AMD Ryzen™ 8000 Series Desktop Processors (formerly codenamed "Phoenix") (AMD) Fixed in ComboAM5PI_1.3.0.0
  • Fix · CNA AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed "Genoa") (AMD) Fixed in EmbGenoaPI-SP5 1.0.0.D
  • Fix · CNA AMD EPYC™ Embedded 8004 Series Processors (AMD) Fixed in EmbGenoaPI-SP5 1.0.0.D
  • Fix · CNA AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed "Bergamo") (AMD) Fixed in EmbGenoaPI-SP5 1.0.0.D
  • Fix · CNA AMD Ryzen™ Embedded 8000 Series Processors (AMD) Fixed in EmbeddedPhoenixPI-FP7r2_1.0.0.3
  • Fix · CNA AMD Ryzen™ Embedded 7000 Series Processors (AMD) Fixed in EmbeddedAM5PI 1.0.0.5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-36315
  2. 2026-10-27 Alias added: GHSA-48h8-ccw7-958p

References

Other 2

  • TI-2026-36341 AI Tensor Engine for ROCm (AITER) 0.1.14 Unauthenticated RCE via MessageQueue.recv() Pickle Deserialization CVSS 4.0CRITICAL 9.2
  • TI-2023-07046 Improper privilege management in AMD Radeon™ RX 5000 Series Graphics Cards CVSS 3.1HIGH 7.8
  • TI-2023-04574 GPU kernel implementations susceptible to memory leak CVSS 3.1MEDIUM 6.5
  • TI-2023-07042 Information disclosure through error messages in AMD Ryzen™ 3000 Series Desktop… CVSS 3.1MEDIUM 5.5
  • TI-2023-23747 PVRIC (PowerVR Image Compression) on Imagination 2018 and later GPU devices offers… CVSS 3.1MEDIUM 5.3
  • TI-2022-07839 Improper access control in System Management Mode (SMM) may allow an attacker to write to… CVSS 3.1CRITICAL 9.8
See all 508 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences