#VU112549 Information exposure through microarchitectural state after transient execution in AMD products - CVE-2024-36350

Vulnerability identifier: #VU112549

Vulnerability risk: Low

CVSSv4.0: CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

CVE-ID: CVE-2024-36350

CWE-ID: CWE-1342

Exploitation vector: Local access

Exploit availability: No public exploit available

Vulnerable software:
3rd Gen AMD EPYC Processors
4th Gen AMD EPYC Processors
AMD Instinct MI300A
AMD Ryzen 5000 Series Desktop processor
AMD Ryzen 5000 Series Desktop processor with Radeon graphics
AMD Ryzen 7000 Series Desktop Processors

Software vendor:
AMD

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to information leak. A local user can obtain sensitive data from previous stores.

Install updates from vendor's website.

• https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7029.html