Read the docs
TI-2024-24141 Aliases CVE-2024-36347GHSA-fxg4-qp5q-79p3

Improper signature verification in AMD EPYC™ 7001 Series

Priority LOW 29CWE-347Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-347.

Summary

Improper signature verification in AMD CPU ROM microcode patch loader may allow an attacker with local administrator privilege to load malicious microcode, potentially resulting in loss of integrity of x86 instruction execution, loss of confidentiality and integrity of data in x86 CPU privileged context and compromise of SMM execution environment.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00107 1st percentileScored 2026-11-07
Fix Fixed AMD EPYC™ 7001 Series (AMD): NaplesPI 1.0.0.PAMD EPYC™ 7002 Series (AMD): RomePI 1.0.0.L+44 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AMDAMD EPYC™ 7001 Series—NaplesPI 1.0.0.PPatch availableCNA
AMDAMD EPYC™ 7002 Series—RomePI 1.0.0.LPatch availableCNA
AMDAMD EPYC™ 7003 Series—MilanPI 1.0.0.FPatch availableCNA
AMDAMD EPYC™ 9004 Series—Genoa 1.0.0.EPatch availableCNA
AMDAMD EPYC™ 4004 Series—ComboAM5PI1.0.0.a, ComboAM5PI1.1.0.3c, ComboAM5PI1.2.0.3Patch availableCNA
AMDAMD EPYC™ 9005 Series—TurinPI 1.0.0.4Patch availableCNA
AMDAMD Instinct™ MI300A—MI300PI_SR5 1.0.0.8Patch availableCNA
AMDAMD Ryzen™ 5000 Series Desktop Processors—ComboAM4v2PI 1.2.0.EPatch availableCNA
AMDAMD Ryzen™ 5000 Series Desktop Processor with Radeon™ Graphics—ComboAM4v2PI 1.2.0.EPatch availableCNA
AMDAMD Ryzen™ 3000 Series Desktop Processors—ComboAM4PI 1.0.0.D, ComboAM4v2PI 1.2.0.EPatch availableCNA
AMDAMD Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics—ComboAM4PI 1.0.0.D, ComboAM4v2PI 1.2.0.EPatch availableCNA
AMDAMD Ryzen™ 7000 Series Desktop Processors—ComboAM5PI 1.0.0.a, ComboAM5PI 1.1.0.3c, ComboAM5PI 1.2.0.3Patch availableCNA
AMDAMD Ryzen™ 4000 Series Desktop Processor with Radeon™ Graphics—ComboAM4v2PI 1.2.0.EPatch availableCNA
AMDAMD Ryzen™ 8000 Series Processor with Radeon™ Graphics—ComboAM5PI 1.1.0.3c, ComboAM5PI 1.2.0.3Patch availableCNA
AMDAMD Ryzen™ 9000 Series Desktop Processors—ComboAM5PI 1.2.0.3cPatch availableCNA
AMDAMD Ryzen™ Threadripper™ 3000 Series Processors—CastlePeakPI-SP3r3 1.0.0.EPatch availableCNA
AMDAMD Ryzen™ Threadripper™ PRO 7000 WX-Series Processors—StormPeakPI-SP6 1.0.0.1k, StormPeakPI-SP6 1.1.0.0iPatch availableCNA
AMDAMD Ryzen™ Threadripper™ PRO 3000WX Series Processors—ChagallWSPI-sWRX8 1.0.0.B, CastlePeakWSPI-sWRX8 1.0.0.gPatch availableCNA
AMDAMD Ryzen™ Threadripper™ PRO 5000WX- Series Desktop Processors—ChagallWSPI-sWRX8 1.0.0.BPatch availableCNA
AMDAMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics—PicassoPI-FP5 1.0.1.2bPatch availableCNA
AMDAMD Ryzen™ 3000 Series Mobile Processor with Radeon™ Graphics—PicassoPI-FP5 1.0.1.2bPatch availableCNA
AMDAMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics—RenoirPI-FP6 1.0.0.EbPatch availableCNA
AMDAMD Ryzen™ 5000 Series Processors with Radeon™ Graphics—CezannePI-FP6 1.0.1.1bPatch availableCNA
AMDAMD Ryzen™ 7020 Series Processors with Radeon™ Graphics—MendocinoPI-FT6 1.0.0.7bPatch availableCNA
AMDAMD Ryzen™ 6000 Series Processor with Radeon™ Graphics—RembrandtPI-FP7 1.0.0.BbPatch availableCNA
AMDAMD Ryzen™ 7035 Series Processor with Radeon™ Graphics—RembrandtPI-FP7 1.0.0.BbPatch availableCNA
AMDAMD Ryzen™ 7000 Series Processors with Radeon™ Graphics—CezannePI-FP6 1.0.1.1bPatch availableCNA
AMDAMD Ryzen™ 7040 Series Processors with Radeon™ Graphics—PhoenixPI-FP8-FP7 1.2.0.0Patch availableCNA
AMDAMD Ryzen™ 8040 Series Mobile Processors with Radeon™ Graphics—PhoenixPI-FP8-FP7 1.2.0.0Patch availableCNA
AMDAMD Ryzen™ 7045 Series Mobile Processors—DragonRangeFL1 1.0.0.3gPatch availableCNA
AMDAMD Ryzen™ AI 300 Series—StrixKrakenPI-FP8_1.1.0.0bPatch availableCNA
AMDAMD Ryzen™ AI Max +—StrixHaloPI-FP11_1.0.0.1Patch availableCNA
AMDAMD Ryzen™ 9000HX Series Mobile Processors—FireRangeFL1PI 1.0.0.0aPatch availableCNA
AMDAMD EPYC™ Embedded 3000—SnowyOwl PI 1.1.0.EPatch availableCNA
AMDAMD EPYC™ Embedded 7002—EmbRomePI-SP3 1.0.0.DPatch availableCNA
AMDAMD EPYC™ Embedded 7003—EmbMilan PI-SP3 1.0.0.APatch availableCNA
AMDAMD EPYC™ Embedded 8004—EmbGenoaPI-SP5 1.0.0.9Patch availableCNA
AMDAMD EPYC™ Embedded 9004—EmbGenoaPI-SP5 1.0.0.9Patch availableCNA
AMDAMD EPYC™ Embedded 97X4—EmbGenoaPI-SP5 1.0.0.9Patch availableCNA
AMDAMD Ryzen™ Embedded R1000—EmbeddedPI-FP5 1.2.0.FPatch availableCNA
AMDAMD Ryzen™ Embedded R2000—EmbeddedR2KPI 1.0.0.5Patch availableCNA
AMDAMD Ryzen™ Embedded 5000—EmbAM4PI 1.0.0.7Patch availableCNA
AMDAMD Ryzen™ Embedded 7000—EmbeddedAM5PI 1.0.0.3Patch availableCNA
AMDAMD Ryzen™ Embedded V1000—EmbeddedPI-FP5 1.2.0.FPatch availableCNA
AMDAMD Ryzen™Embedded V2000—EmbeddedPI-FP6 1.0.0.BPatch availableCNA
AMDAMD Ryzen™Embedded V3000—EmbeddedPI-FP7R2 1.0.0.CPatch availableCNA
  • AMD EPYC™ 7001 Series VendorAMD Affected — Fixed in NaplesPI 1.0.0.P Patch available CNA
  • AMD EPYC™ 7002 Series VendorAMD Affected — Fixed in RomePI 1.0.0.L Patch available CNA
  • AMD EPYC™ 7003 Series VendorAMD Affected — Fixed in MilanPI 1.0.0.F Patch available CNA
  • AMD EPYC™ 9004 Series VendorAMD Affected — Fixed in Genoa 1.0.0.E Patch available CNA
  • AMD EPYC™ 4004 Series VendorAMD Affected — Fixed in ComboAM5PI1.0.0.a, ComboAM5PI1.1.0.3c, ComboAM5PI1.2.0.3 Patch available CNA
  • AMD EPYC™ 9005 Series VendorAMD Affected — Fixed in TurinPI 1.0.0.4 Patch available CNA
  • AMD Instinct™ MI300A VendorAMD Affected — Fixed in MI300PI_SR5 1.0.0.8 Patch available CNA
  • AMD Ryzen™ 5000 Series Desktop Processors VendorAMD Affected — Fixed in ComboAM4v2PI 1.2.0.E Patch available CNA
  • AMD Ryzen™ 5000 Series Desktop Processor with Radeon™ Graphics VendorAMD Affected — Fixed in ComboAM4v2PI 1.2.0.E Patch available CNA
  • AMD Ryzen™ 3000 Series Desktop Processors VendorAMD Affected — Fixed in ComboAM4PI 1.0.0.D, ComboAM4v2PI 1.2.0.E Patch available CNA
  • AMD Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics VendorAMD Affected — Fixed in ComboAM4PI 1.0.0.D, ComboAM4v2PI 1.2.0.E Patch available CNA
  • AMD Ryzen™ 7000 Series Desktop Processors VendorAMD Affected — Fixed in ComboAM5PI 1.0.0.a, ComboAM5PI 1.1.0.3c, ComboAM5PI 1.2.0.3 Patch available CNA
  • AMD Ryzen™ 4000 Series Desktop Processor with Radeon™ Graphics VendorAMD Affected — Fixed in ComboAM4v2PI 1.2.0.E Patch available CNA
  • AMD Ryzen™ 8000 Series Processor with Radeon™ Graphics VendorAMD Affected — Fixed in ComboAM5PI 1.1.0.3c, ComboAM5PI 1.2.0.3 Patch available CNA
  • AMD Ryzen™ 9000 Series Desktop Processors VendorAMD Affected — Fixed in ComboAM5PI 1.2.0.3c Patch available CNA
  • AMD Ryzen™ Threadripper™ 3000 Series Processors VendorAMD Affected — Fixed in CastlePeakPI-SP3r3 1.0.0.E Patch available CNA
  • AMD Ryzen™ Threadripper™ PRO 7000 WX-Series Processors VendorAMD Affected — Fixed in StormPeakPI-SP6 1.0.0.1k, StormPeakPI-SP6 1.1.0.0i Patch available CNA
  • AMD Ryzen™ Threadripper™ PRO 3000WX Series Processors VendorAMD Affected — Fixed in ChagallWSPI-sWRX8 1.0.0.B, CastlePeakWSPI-sWRX8 1.0.0.g Patch available CNA
  • AMD Ryzen™ Threadripper™ PRO 5000WX- Series Desktop Processors VendorAMD Affected — Fixed in ChagallWSPI-sWRX8 1.0.0.B Patch available CNA
  • AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics VendorAMD Affected — Fixed in PicassoPI-FP5 1.0.1.2b Patch available CNA
  • AMD Ryzen™ 3000 Series Mobile Processor with Radeon™ Graphics VendorAMD Affected — Fixed in PicassoPI-FP5 1.0.1.2b Patch available CNA
  • AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics VendorAMD Affected — Fixed in RenoirPI-FP6 1.0.0.Eb Patch available CNA
  • AMD Ryzen™ 5000 Series Processors with Radeon™ Graphics VendorAMD Affected — Fixed in CezannePI-FP6 1.0.1.1b Patch available CNA
  • AMD Ryzen™ 7020 Series Processors with Radeon™ Graphics VendorAMD Affected — Fixed in MendocinoPI-FT6 1.0.0.7b Patch available CNA
  • AMD Ryzen™ 6000 Series Processor with Radeon™ Graphics VendorAMD Affected — Fixed in RembrandtPI-FP7 1.0.0.Bb Patch available CNA
  • AMD Ryzen™ 7035 Series Processor with Radeon™ Graphics VendorAMD Affected — Fixed in RembrandtPI-FP7 1.0.0.Bb Patch available CNA
  • AMD Ryzen™ 7000 Series Processors with Radeon™ Graphics VendorAMD Affected — Fixed in CezannePI-FP6 1.0.1.1b Patch available CNA
  • AMD Ryzen™ 7040 Series Processors with Radeon™ Graphics VendorAMD Affected — Fixed in PhoenixPI-FP8-FP7 1.2.0.0 Patch available CNA
  • AMD Ryzen™ 8040 Series Mobile Processors with Radeon™ Graphics VendorAMD Affected — Fixed in PhoenixPI-FP8-FP7 1.2.0.0 Patch available CNA
  • AMD Ryzen™ 7045 Series Mobile Processors VendorAMD Affected — Fixed in DragonRangeFL1 1.0.0.3g Patch available CNA
  • AMD Ryzen™ AI 300 Series VendorAMD Affected — Fixed in StrixKrakenPI-FP8_1.1.0.0b Patch available CNA
  • AMD Ryzen™ AI Max + VendorAMD Affected — Fixed in StrixHaloPI-FP11_1.0.0.1 Patch available CNA
  • AMD Ryzen™ 9000HX Series Mobile Processors VendorAMD Affected — Fixed in FireRangeFL1PI 1.0.0.0a Patch available CNA
  • AMD EPYC™ Embedded 3000 VendorAMD Affected — Fixed in SnowyOwl PI 1.1.0.E Patch available CNA
  • AMD EPYC™ Embedded 7002 VendorAMD Affected — Fixed in EmbRomePI-SP3 1.0.0.D Patch available CNA
  • AMD EPYC™ Embedded 7003 VendorAMD Affected — Fixed in EmbMilan PI-SP3 1.0.0.A Patch available CNA
  • AMD EPYC™ Embedded 8004 VendorAMD Affected — Fixed in EmbGenoaPI-SP5 1.0.0.9 Patch available CNA
  • AMD EPYC™ Embedded 9004 VendorAMD Affected — Fixed in EmbGenoaPI-SP5 1.0.0.9 Patch available CNA
  • AMD EPYC™ Embedded 97X4 VendorAMD Affected — Fixed in EmbGenoaPI-SP5 1.0.0.9 Patch available CNA
  • AMD Ryzen™ Embedded R1000 VendorAMD Affected — Fixed in EmbeddedPI-FP5 1.2.0.F Patch available CNA
  • AMD Ryzen™ Embedded R2000 VendorAMD Affected — Fixed in EmbeddedR2KPI 1.0.0.5 Patch available CNA
  • AMD Ryzen™ Embedded 5000 VendorAMD Affected — Fixed in EmbAM4PI 1.0.0.7 Patch available CNA
  • AMD Ryzen™ Embedded 7000 VendorAMD Affected — Fixed in EmbeddedAM5PI 1.0.0.3 Patch available CNA
  • AMD Ryzen™ Embedded V1000 VendorAMD Affected — Fixed in EmbeddedPI-FP5 1.2.0.F Patch available CNA
  • AMD Ryzen™Embedded V2000 VendorAMD Affected — Fixed in EmbeddedPI-FP6 1.0.0.B Patch available CNA
  • AMD Ryzen™Embedded V3000 VendorAMD Affected — Fixed in EmbeddedPI-FP7R2 1.0.0.C Patch available CNA

Remediation

  • Fix · CNA AMD EPYC™ 7001 Series (AMD) Fixed in NaplesPI 1.0.0.P
  • Fix · CNA AMD EPYC™ 7002 Series (AMD) Fixed in RomePI 1.0.0.L
  • Fix · CNA AMD EPYC™ 7003 Series (AMD) Fixed in MilanPI 1.0.0.F
  • Fix · CNA AMD EPYC™ 9004 Series (AMD) Fixed in Genoa 1.0.0.E
  • Fix · CNA AMD EPYC™ 4004 Series (AMD) Fixed in ComboAM5PI1.0.0.a, ComboAM5PI1.1.0.3c, ComboAM5PI1.2.0.3
  • Fix · CNA AMD EPYC™ 9005 Series (AMD) Fixed in TurinPI 1.0.0.4
  • Fix · CNA AMD Instinct™ MI300A (AMD) Fixed in MI300PI_SR5 1.0.0.8
  • Fix · CNA AMD Ryzen™ 5000 Series Desktop Processors (AMD) Fixed in ComboAM4v2PI 1.2.0.E
  • Fix · CNA AMD Ryzen™ 5000 Series Desktop Processor with Radeon™ Graphics (AMD) Fixed in ComboAM4v2PI 1.2.0.E
  • Fix · CNA AMD Ryzen™ 3000 Series Desktop Processors (AMD) Fixed in ComboAM4PI 1.0.0.D, ComboAM4v2PI 1.2.0.E
  • Fix · CNA AMD Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics (AMD) Fixed in ComboAM4PI 1.0.0.D, ComboAM4v2PI 1.2.0.E
  • Fix · CNA AMD Ryzen™ 7000 Series Desktop Processors (AMD) Fixed in ComboAM5PI 1.0.0.a, ComboAM5PI 1.1.0.3c, ComboAM5PI 1.2.0.3
  • Fix · CNA AMD Ryzen™ 4000 Series Desktop Processor with Radeon™ Graphics (AMD) Fixed in ComboAM4v2PI 1.2.0.E
  • Fix · CNA AMD Ryzen™ 8000 Series Processor with Radeon™ Graphics (AMD) Fixed in ComboAM5PI 1.1.0.3c, ComboAM5PI 1.2.0.3
  • Fix · CNA AMD Ryzen™ 9000 Series Desktop Processors (AMD) Fixed in ComboAM5PI 1.2.0.3c
  • Fix · CNA AMD Ryzen™ Threadripper™ 3000 Series Processors (AMD) Fixed in CastlePeakPI-SP3r3 1.0.0.E
  • Fix · CNA AMD Ryzen™ Threadripper™ PRO 7000 WX-Series Processors (AMD) Fixed in StormPeakPI-SP6 1.0.0.1k, StormPeakPI-SP6 1.1.0.0i
  • Fix · CNA AMD Ryzen™ Threadripper™ PRO 3000WX Series Processors (AMD) Fixed in ChagallWSPI-sWRX8 1.0.0.B, CastlePeakWSPI-sWRX8 1.0.0.g
  • Fix · CNA AMD Ryzen™ Threadripper™ PRO 5000WX- Series Desktop Processors (AMD) Fixed in ChagallWSPI-sWRX8 1.0.0.B
  • Fix · CNA AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics (AMD) Fixed in PicassoPI-FP5 1.0.1.2b
  • Fix · CNA AMD Ryzen™ 3000 Series Mobile Processor with Radeon™ Graphics (AMD) Fixed in PicassoPI-FP5 1.0.1.2b
  • Fix · CNA AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics (AMD) Fixed in RenoirPI-FP6 1.0.0.Eb
  • Fix · CNA AMD Ryzen™ 5000 Series Processors with Radeon™ Graphics (AMD) Fixed in CezannePI-FP6 1.0.1.1b
  • Fix · CNA AMD Ryzen™ 7020 Series Processors with Radeon™ Graphics (AMD) Fixed in MendocinoPI-FT6 1.0.0.7b
  • Fix · CNA AMD Ryzen™ 6000 Series Processor with Radeon™ Graphics (AMD) Fixed in RembrandtPI-FP7 1.0.0.Bb
  • Fix · CNA AMD Ryzen™ 7035 Series Processor with Radeon™ Graphics (AMD) Fixed in RembrandtPI-FP7 1.0.0.Bb
  • Fix · CNA AMD Ryzen™ 7000 Series Processors with Radeon™ Graphics (AMD) Fixed in CezannePI-FP6 1.0.1.1b
  • Fix · CNA AMD Ryzen™ 7040 Series Processors with Radeon™ Graphics (AMD) Fixed in PhoenixPI-FP8-FP7 1.2.0.0
  • Fix · CNA AMD Ryzen™ 8040 Series Mobile Processors with Radeon™ Graphics (AMD) Fixed in PhoenixPI-FP8-FP7 1.2.0.0
  • Fix · CNA AMD Ryzen™ 7045 Series Mobile Processors (AMD) Fixed in DragonRangeFL1 1.0.0.3g
  • Fix · CNA AMD Ryzen™ AI 300 Series (AMD) Fixed in StrixKrakenPI-FP8_1.1.0.0b
  • Fix · CNA AMD Ryzen™ AI Max + (AMD) Fixed in StrixHaloPI-FP11_1.0.0.1
  • Fix · CNA AMD Ryzen™ 9000HX Series Mobile Processors (AMD) Fixed in FireRangeFL1PI 1.0.0.0a
  • Fix · CNA AMD EPYC™ Embedded 3000 (AMD) Fixed in SnowyOwl PI 1.1.0.E
  • Fix · CNA AMD EPYC™ Embedded 7002 (AMD) Fixed in EmbRomePI-SP3 1.0.0.D
  • Fix · CNA AMD EPYC™ Embedded 7003 (AMD) Fixed in EmbMilan PI-SP3 1.0.0.A
  • Fix · CNA AMD EPYC™ Embedded 8004 (AMD) Fixed in EmbGenoaPI-SP5 1.0.0.9
  • Fix · CNA AMD EPYC™ Embedded 9004 (AMD) Fixed in EmbGenoaPI-SP5 1.0.0.9
  • Fix · CNA AMD EPYC™ Embedded 97X4 (AMD) Fixed in EmbGenoaPI-SP5 1.0.0.9
  • Fix · CNA AMD Ryzen™ Embedded R1000 (AMD) Fixed in EmbeddedPI-FP5 1.2.0.F
  • Fix · CNA AMD Ryzen™ Embedded R2000 (AMD) Fixed in EmbeddedR2KPI 1.0.0.5
  • Fix · CNA AMD Ryzen™ Embedded 5000 (AMD) Fixed in EmbAM4PI 1.0.0.7
  • Fix · CNA AMD Ryzen™ Embedded 7000 (AMD) Fixed in EmbeddedAM5PI 1.0.0.3
  • Fix · CNA AMD Ryzen™ Embedded V1000 (AMD) Fixed in EmbeddedPI-FP5 1.2.0.F
  • Fix · CNA AMD Ryzen™Embedded V2000 (AMD) Fixed in EmbeddedPI-FP6 1.0.0.B
  • Fix · CNA AMD Ryzen™Embedded V3000 (AMD) Fixed in EmbeddedPI-FP7R2 1.0.0.C

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Not affected: 5 products
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-36347
  2. 2026-10-03 Alias added: GHSA-fxg4-qp5q-79p3

References

  • TI-2026-36341 AI Tensor Engine for ROCm (AITER) 0.1.14 Unauthenticated RCE via MessageQueue.recv() Pickle Deserialization CVSS 4.0CRITICAL 9.2
  • TI-2023-07046 Improper privilege management in AMD Radeon™ RX 5000 Series Graphics Cards CVSS 3.1HIGH 7.8
  • TI-2023-04574 GPU kernel implementations susceptible to memory leak CVSS 3.1MEDIUM 6.5
  • TI-2023-07042 Information disclosure through error messages in AMD Ryzen™ 3000 Series Desktop… CVSS 3.1MEDIUM 5.5
  • TI-2023-23747 PVRIC (PowerVR Image Compression) on Imagination 2018 and later GPU devices offers… CVSS 3.1MEDIUM 5.3
  • TI-2022-07839 Improper access control in System Management Mode (SMM) may allow an attacker to write to… CVSS 3.1CRITICAL 9.8
See all 508 →

Sources