#VU112552 Information exposure through microarchitectural state after transient execution in AMD products - CVE-2024-36357

Vulnerability identifier: #VU112552

Vulnerability risk: Low

CVSSv4.0: CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

CVE-ID: CVE-2024-36357

CWE-ID: CWE-1342

Exploitation vector: Local access

Exploit availability: No public exploit available

Vulnerable software:
3rd Gen AMD EPYC Processors
4th Gen AMD EPYC Processors
AMD Instinct MI300A
AMD Ryzen 5000 Series Desktop processor
AMD Ryzen 5000 Series Desktop processor with Radeon graphics
AMD Ryzen 7000 Series Desktop Processors

Software vendor:
AMD

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to information leak. A local user can obtain sensitive data from the L1D cache.

Install updates from vendor's website.

• https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7029.html