CVE-2024-56161
First published: Mon Feb 03 2025(Updated: )
Improper signature verification in AMD CPU ROM microcode patch loader may allow an attacker with local administrator privilege to load malicious CPU microcode resulting in loss of confidentiality and integrity of a confidential guest running under AMD SEV-SNP.
Credit: psirt@amd.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| AMD CPU ROM microcode patch loader |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3019.html
- http://www.openwall.com/lists/oss-security/2025/02/04/1
- https://www.theregister.com/2025/02/04/google_amd_microcode/
- https://www.bleepingcomputer.com/news/security/amd-fixes-bug-that-lets-hackers-load-malicious-microcode-patches/
Frequently Asked Questions
What is the severity of CVE-2024-56161?
CVE-2024-56161 has a high severity due to the potential for loss of confidentiality and integrity of confidential guests running under AMD SEV-SNP.
How do I fix CVE-2024-56161?
To fix CVE-2024-56161, apply the latest firmware updates provided by AMD for the CPU ROM microcode patch loader.
What systems are affected by CVE-2024-56161?
CVE-2024-56161 affects systems utilizing AMD CPU ROM microcode patch loader, particularly those running AMD SEV-SNP.
Who can exploit CVE-2024-56161?
An attacker with local administrator privileges can exploit CVE-2024-56161 to load malicious CPU microcode.
What are the potential impacts of CVE-2024-56161?
The potential impacts of CVE-2024-56161 include unauthorized access to sensitive information and compromise of the integrity of guest systems.
- agent/weakness
- agent/author
- agent/type
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/first-publish-date
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- collector/the-register
- source/The Register
- alias/CVE-2024-56161
- agent/references
- agent/severity
- agent/source
- agent/tags
- agent/event
- agent/trending
- collector/bleeping-computer
- source/BleepingComputer
- agent/news-ai
- exploited/true
- vendor/amd
- canonical/amd cpu rom microcode patch loader