Processor vulnerability
CVE-2024-21924
An SMM module used boot services handlers that ring 0 code can change, so an attacker could run code in SMM on Rome-based EPYC and Threadripper PRO.
- Name
- SMM callout in AmdPlatformRasSspSmm
- Vulnerability
- AMD AGESA, SMM and BIOS firmware
- Kind
- Firmware
- CVE published
- 2025-02-11 CVE record
- Advisories
- AMD-SB-7028
Eclypsium reported that the AmdPlatformRasSspSmm UEFI module calls
out of SMM. In AMD’s analysis, ring 0 code could point the boot
services table the module uses at its own code and so run it in
System Management Mode. The bulletin lists EPYC 7002, EPYC Embedded
7002 and the Threadripper PRO 3000 WX, 5000 WX and 7000 WX lines,
fixed in PI firmware from September to December 2024.What the sources say of each microarchitecture.
Affected processors
3 of the 3 microarchitectures listed are affected in all or some of their models.
Mitigations
- Firmware: RomePI 1.0.0.K, EmbRomePI-SP3 1.0.0.D, ChagallWSPI-sWRX8 1.0.0.9, CastlePeakWSPI-sWRX8 1.0.0.E and StormPeakPI-SP6 1.0.0.1j or 1.1.0.0h. Source.
Related CVEs
- CVE-2020-12890 SMM callout in AGESA
- CVE-2020-12954 Chipset option bypasses SPI ROM protection
- CVE-2021-26316 BIOS communication buffer
- CVE-2021-26317 SMM protocol not verified
- CVE-2021-26384 SMI trigger data
- CVE-2021-26388 BIOS directory search
- CVE-2021-39298 SMM interrupt handler
- CVE-2022-23820 SMM communication buffer
- CVE-2022-23821 SPI ROM writes through SMM
- CVE-2022-23829 SPI lock bypass
- CVE-2023-20555 CpmDisplayFeatureSmm bit overwrite
- CVE-2023-20558 AmdCpmOemSmm control flow
- CVE-2023-20559 AmdCpmGpioInitSmm control flow
- CVE-2023-20563 SMM code protections
- CVE-2023-20565 SMM code protections (second CVE)
- CVE-2023-20571 SMM race with CVE-2018-8897
- CVE-2023-20576 AGESA data authenticity
- CVE-2023-20577 SMM module heap overflow
- CVE-2023-20578 SMM communication buffer race
- CVE-2023-20579 SPI protection bypass from ring 0
- CVE-2023-20587 SPI flash through SMM
- CVE-2023-20594 DXE driver variables (1)
- CVE-2023-20596 SMM Supervisor initialization
- CVE-2023-20597 DXE driver variables (2)
- CVE-2023-31315 SMM lock bypass
- CVE-2023-31342 SMM handler overwrites SMRAM (1)
- CVE-2023-31343 SMM handler overwrites SMRAM (2)
- CVE-2023-31345 SMM handler overwrites SMRAM (3)
- CVE-2024-0179 SMM callout in AmdCpmDisplayFeatureSMM
- CVE-2024-21925 AmdPspP2CmboxV2 input validation
- CVE-2024-21947 SMM arbitrary memory write
- CVE-2024-36310 SMM communication buffer bounds
- CVE-2024-36311 SMM communication buffer race
- CVE-2024-36326 RomArmor on resume
- CVE-2024-36343 SMM buffer and TSEG
- CVE-2024-36345 AMD OverDrive SMM module
- CVE-2024-36354 DIMM SPD data and SMM
- CVE-2024-36355 SMM handler and S3 resume
- CVE-2025-29950 SMM stack overwrite
- CVE-2025-54502 LocateProtocol in the APCB SMM driver
- CVE-2026-0438 SMM callout