Input validation error in AMD Instinct MI300X - CVE-2024-21936
Published: February 24, 2025
Vulnerability identifier: #VU104140
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-21936
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input in Satellite Management Controller (SMC). A remote user can pass specially crafted input to the application and perform a denial of service (DoS) attack.
Affected software
AMD Instinct MI300X
ThinkSystem SR685a V3
AMD Graphics Processing Unit (GPU) Adapter Firmware
ThinkSystem SR685a V3
AMD Graphics Processing Unit (GPU) Adapter Firmware
How to mitigate CVE-2024-21936
Install updates from vendor's website.
AMD Instinct MI300X - update to 24.10
AMD Graphics Processing Unit (GPU) Adapter Firmware - update to BKC 24.12.10
AMD Graphics Processing Unit (GPU) Adapter Firmware - update to BKC 24.12.10