Source: Quarkslab

AMD has released security patches addressing two high-severity vulnerabilities impacting its System Management Mode (SMM), a privileged execution environment within the firmware of AMD processors. If exploited, these vulnerabilities could allow privileged attackers to execute arbitrary code and potentially compromise system integrity.

The vulnerabilities, tracked as CVE-2024-0179 and CVE-2024-21925, both carry a CVSS score of 8.2 (High). According to AMD, these flaws were reported by Quarkslab and affect multiple generations of AMD EPYC and Ryzen processors.

• CVE-2024-0179 is an SMM Callout vulnerability within the AmdCpmDisplayFeatureSMM UEFI module. AMD warns that this issue “could allow locally authenticated attackers to overwrite SMRAM, potentially resulting in arbitrary code execution.”
• CVE-2024-21925 stems from insufficient input validation in the AmdPspP2CmboxV2 UEFI module, which may allow a privileged attacker to overwrite SMRAM, leading to arbitrary code execution.

Both vulnerabilities exploit System Management RAM (SMRAM), a critical memory region used by SMM handlers, which is meant to be isolated from unauthorized access. Attackers with the required privileges could escalate their access to execute malicious payloads at ring-0—the highest level of system privilege.

The vulnerabilities affect multiple processor families, including:

• 1st to 4th Gen AMD EPYC processors (Naples, Rome, Milan, Genoa)
• AMD Ryzen 5000/7000 series desktop and mobile processors
• AMD Ryzen Threadripper PRO and High-End Desktop (HEDT) processors
• AMD Instinct MI300A Data Center GPUs

AMD acknowledged Gabrielle Viala from Quarkslab for responsibly disclosing these issues.

According to AMD, mitigation requires firmware updates to the Platform Initialization (PI) firmware. The company has provided specific firmware versions for affected processors, including Naples PI 1.0.0.N (2024-09-17), Rome PI 1.0.0.K (2024-09-05), and Milan PI 1.0.0.E (2024-09-05).

To address these security risks, AMD recommends users update their firmware via their OEM vendors. The company notes that patches have been integrated into BIOS updates to mitigate the vulnerabilities at the firmware level.

Related Posts:

• AMD Extends Security Patch for RYZEN 3000, Addressing Critical SMM Vulnerability
• Researcher: Spectre CPU flaws can be used to break into the highly privileged CPU mode on Intel x86 systems
• AMD: CPU security patch for Ryzen and EPYC processors come on this week
• AMD discloses over 50 vulnerabilities that affect EPYC processor and Radeon graphics driver