Processor vulnerability
CVE-2024-0179
An SMM module of AGESA called code outside SMRAM, so a local attacker with privileges could overwrite SMRAM and run code in SMM.
- Name
- SMM callout in AmdCpmDisplayFeatureSMM
- Vulnerability
- AMD AGESA, SMM and BIOS firmware
- Kind
- Firmware
- CVE published
- 2025-02-11 CVE record
- Advisories
- AMD-SB-7027
Quarkslab found that the AmdCpmDisplayFeatureSMM UEFI module, part
of AMD’s AGESA, calls code that lies outside SMRAM. An attacker at
ring 0 who replaces that code gets it run in System Management Mode.
EPYC and the embedded EPYC lines are not affected; the client lines
from the Athlon 3000 to the Ryzen 8000 series received fixed PI
firmware from September 2024 to February 2025.What the sources say of each microarchitecture.
Affected processors
5 of the 5 microarchitectures listed are affected in all or some of their models.
| Microarchitecture | Status | Detail | Source |
|---|---|---|---|
| Zen | Affected | Athlon 3000 mobile, Ryzen Embedded R1000 and V1000 | amd.com |
| Zen+ | Affected | Ryzen Embedded R2000 | amd.com |
| Zen 2 | Affected | Ryzen 3000 desktop, Ryzen 4000, Ryzen 7020, Threadripper 3000 and PRO 3000 WX, Ryzen Embedded V2000 | amd.com |
| Zen 3 | Affected | Ryzen 5000, Ryzen 6000, Ryzen 7035, Ryzen Embedded 5000 and V3000 | amd.com |
| Zen 4 | Affected | Ryzen 7000, 7040, 7045 and 8000, Threadripper PRO 7000 WX, Ryzen Embedded 7000 and 8000 | amd.com |
Mitigations
- Firmware: PI firmware such as ComboAM4v2PI 1.2.0.D, ComboAM5PI 1.2.0.2b and PhoenixPI-FP8-FP7 1.1.8.0, and the other versions the bulletin lists. Source.
Related CVEs
- CVE-2020-12890 SMM callout in AGESA
- CVE-2020-12954 Chipset option bypasses SPI ROM protection
- CVE-2021-26316 BIOS communication buffer
- CVE-2021-26317 SMM protocol not verified
- CVE-2021-26384 SMI trigger data
- CVE-2021-26388 BIOS directory search
- CVE-2021-39298 SMM interrupt handler
- CVE-2022-23820 SMM communication buffer
- CVE-2022-23821 SPI ROM writes through SMM
- CVE-2022-23829 SPI lock bypass
- CVE-2023-20555 CpmDisplayFeatureSmm bit overwrite
- CVE-2023-20558 AmdCpmOemSmm control flow
- CVE-2023-20559 AmdCpmGpioInitSmm control flow
- CVE-2023-20563 SMM code protections
- CVE-2023-20565 SMM code protections (second CVE)
- CVE-2023-20571 SMM race with CVE-2018-8897
- CVE-2023-20576 AGESA data authenticity
- CVE-2023-20577 SMM module heap overflow
- CVE-2023-20578 SMM communication buffer race
- CVE-2023-20579 SPI protection bypass from ring 0
- CVE-2023-20587 SPI flash through SMM
- CVE-2023-20594 DXE driver variables (1)
- CVE-2023-20596 SMM Supervisor initialization
- CVE-2023-20597 DXE driver variables (2)
- CVE-2023-31315 SMM lock bypass
- CVE-2023-31342 SMM handler overwrites SMRAM (1)
- CVE-2023-31343 SMM handler overwrites SMRAM (2)
- CVE-2023-31345 SMM handler overwrites SMRAM (3)
- CVE-2024-21924 SMM callout in AmdPlatformRasSspSmm
- CVE-2024-21925 AmdPspP2CmboxV2 input validation
- CVE-2024-21947 SMM arbitrary memory write
- CVE-2024-36310 SMM communication buffer bounds
- CVE-2024-36311 SMM communication buffer race
- CVE-2024-36326 RomArmor on resume
- CVE-2024-36343 SMM buffer and TSEG
- CVE-2024-36345 AMD OverDrive SMM module
- CVE-2024-36354 DIMM SPD data and SMM
- CVE-2024-36355 SMM handler and S3 resume
- CVE-2025-29950 SMM stack overwrite
- CVE-2025-54502 LocateProtocol in the APCB SMM driver
- CVE-2026-0438 SMM callout