Improper signature verification in AMD CPU ROM microcode patch loader may allow an attacker with local administrator privilege to load malicious microcode. This could potentially result in loss of integrity of x86 instruction execution, as well as loss of confidentiality and integrity of data in x86 CPU privileged context, compromising the SMM execution environment.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.4 | CVE-2024-36347 |
Exploitation
To exploit this vulnerability, an attacker must have local administrator privileges on the affected system. By leveraging these privileges, the attacker can load malicious microcode into the CPU, which can lead to unauthorized access and manipulation of sensitive data and system operations.
Affected Products
- AMD CPUs: Vulnerable to microcode manipulation due to improper signature verification.
Mitigation
To mitigate this vulnerability, it is recommended to apply the latest firmware updates provided by AMD. Additionally, restricting local administrator access and monitoring for unauthorized changes to microcode can help reduce the risk of exploitation.