Improper signature verification in AMD EPYC™ 7001 Series
Priority LOW 34CWE-347Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- High
- User interaction
- None
- Attack complexity
- High
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-347.
Summary
Improper signature verification in AMD CPU ROM microcode patch loader may allow an attacker with local administrator privilege to load malicious CPU microcode resulting in loss of confidentiality and integrity of a confidential guest running under AMD SEV-SNP.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00533 45th percentileScored 2026-11-07
Fix Fixed AMD EPYC™ 7001 Series (AMD): NaplesPI 1.0.0.PAMD EPYC™ 7002 Series (AMD): RomePI 1.0.0.L+2 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| AMD | AMD EPYC™ 7001 Series | — | NaplesPI 1.0.0.P | Patch available | CNA |
| AMD | AMD EPYC™ 7002 Series | — | RomePI 1.0.0.L | Patch available | CNA |
| AMD | AMD EPYC™ 7003 Series | — | MilanPI 1.0.0.F | Patch available | CNA |
| AMD | AMD EPYC™ 9004 Series | — | Genoa 1.0.0.E | Patch available | CNA |
- AMD EPYC™ 7001 Series VendorAMD Affected — Fixed in NaplesPI 1.0.0.P Patch available CNA
- AMD EPYC™ 7002 Series VendorAMD Affected — Fixed in RomePI 1.0.0.L Patch available CNA
- AMD EPYC™ 7003 Series VendorAMD Affected — Fixed in MilanPI 1.0.0.F Patch available CNA
- AMD EPYC™ 9004 Series VendorAMD Affected — Fixed in Genoa 1.0.0.E Patch available CNA
Remediation
- Fix · CNA AMD EPYC™ 7001 Series (AMD) Fixed in NaplesPI 1.0.0.P
- Fix · CNA AMD EPYC™ 7002 Series (AMD) Fixed in RomePI 1.0.0.L
- Fix · CNA AMD EPYC™ 7003 Series (AMD) Fixed in MilanPI 1.0.0.F
- Fix · CNA AMD EPYC™ 9004 Series (AMD) Fixed in Genoa 1.0.0.E
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
Not affected: 6 products
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat OpenShift Container Platform 4
Timeline
- 2026-10-02 Threatist record created from CVE-2024-56161
More AMD vulnerabilities
- TI-2026-36341 AI Tensor Engine for ROCm (AITER) 0.1.14 Unauthenticated RCE via MessageQueue.recv() Pickle Deserialization CVSS 4.0CRITICAL 9.2
- TI-2023-07046 Improper privilege management in AMD Radeon™ RX 5000 Series Graphics Cards CVSS 3.1HIGH 7.8
- TI-2023-04574 GPU kernel implementations susceptible to memory leak CVSS 3.1MEDIUM 6.5
- TI-2023-07042 Information disclosure through error messages in AMD Ryzen™ 3000 Series Desktop… CVSS 3.1MEDIUM 5.5
- TI-2023-23747 PVRIC (PowerVR Image Compression) on Imagination 2018 and later GPU devices offers… CVSS 3.1MEDIUM 5.3
- TI-2022-07839 Improper access control in System Management Mode (SMM) may allow an attacker to write to… CVSS 3.1CRITICAL 9.8
Sources
- CVE-2024-56161 · CVE Program
- CVE-2024-56161 · NVD
- FIRST EPSS
- CVE-2024-56161 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences