CVSS 4.0
4.6 mediumCVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:NCVE-2024-36309
Medium (4.6) in amd.
Missing Lock Bit Protection in the Northbridge IO (NBIO) could allow a privileged attacker to use an intentionally disabled device as part of a remapping attack potentially impacting data confidentiality, integrity, or availability.
Severity
- CWE
- CWE-1233 Security-Sensitive Hardware Controls with Missing Lock Bit Protection
- Published
- Assigned by
- AMD (CNA)
- NVD analysis
- Awaiting analysis
- Record from
- the NVD, synced
Ask an AI about this CVE
Show the prompt
Explain CVE-2024-36309 for an engineer deciding whether to act. Use https://cve.bz/api/public/cves/CVE-2024-36309?via=ask-ai-copy and https://cve.bz/cve/CVE-2024-36309?via=ask-ai-copy as the source of truth: what is affected and which versions fix it, whether it is in CISA KEV, public exploits, and its EPSS (an internet-wide 30-day estimate of exploitation activity, not a forecast for my systems). If they give no fixed versions, use the CVE record https://cveawg.mitre.org/api/cve/CVE-2024-36309 or the vendor advisory, not third-party mirrors. Tell me how to check whether I am affected and how to verify a fix. Cite the sources and say where they are uncertain.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this CVE's id and public links.
Affected
- amd:amd athlon™ 3000 series mobile processors with radeon™ graphics
- amd:amd epyc™ 4004 series processors
- amd:amd epyc™ 4005 series processors
- amd:amd epyc™ 7001 series processors
- amd:amd epyc™ 7002 series processors
- amd:amd epyc™ 7003 series processors
- amd:amd epyc™ 9004 series processors
- amd:amd epyc™ 9005 series processors
- amd:amd epyc™ embedded 3000 series processors
- amd:amd epyc™ embedded 4005 series processors
- amd:amd epyc™ embedded 7002 series processors
- amd:amd epyc™ embedded 7003 series processors
- amd:amd epyc™ embedded 8004 series processors
- amd:amd epyc™ embedded 9004 series processors - bergamo
- amd:amd epyc™ embedded 9004 series processors - genoa
- amd:amd epyc™ embedded 9005 series processors
- amd:amd instinct™ mi300a series processors
- amd:amd ryzen™ 3000 series desktop processors
- amd:amd ryzen™ 3000 series mobile processors with radeon™ graphics
- amd:amd ryzen™ 4000 series desktop processors
- amd:amd ryzen™ 4000 series mobile processors with radeon™ graphics
- amd:amd ryzen™ 5000 series desktop processors
- amd:amd ryzen™ 5000 series desktop processors with radeon™ graphics
- amd:amd ryzen™ 5000 series mobile processors with radeon™ graphics
- amd:amd ryzen™ 6000 series processors with radeon™ graphics
- amd:amd ryzen™ 7000 series desktop processors
- amd:amd ryzen™ 7020 series processors with radeon™ graphics
- amd:amd ryzen™ 7030 series mobile processors with radeon™ graphics
- amd:amd ryzen™ 7035 series processors with radeon™ graphics
- amd:amd ryzen™ 7040 series mobile processors with radeon™ graphics
- amd:amd ryzen™ 7045 series mobile processors with radeon™ graphics
- amd:amd ryzen™ 8000 series desktop processors
- amd:amd ryzen™ 8040 series mobile processors with radeon™ graphics
- amd:amd ryzen™ 9000 series desktop processors
- amd:amd ryzen™ 9000hx series mobile processors
- amd:amd ryzen™ ai 300 series processors
- amd:amd ryzen™ ai max 300 series processors
- amd:amd ryzen™ embedded 5000 series processors
- amd:amd ryzen™ embedded 7000 series processors
- amd:amd ryzen™ embedded 8000 series processors
- amd:amd ryzen™ embedded 9000 series processors
- amd:amd ryzen™ embedded r1000 series processors
- amd:amd ryzen™ embedded r2000 series processors
- amd:amd ryzen™ embedded v1000 series processors (formerly codenamed "raven ridge")
- amd:amd ryzen™ embedded v2000 series processors
- amd:amd ryzen™ embedded v3000 series processors
- amd:amd ryzen™ threadripper™ 3000 processors
- amd:amd ryzen™ threadripper™ 7000 processors
- amd:amd ryzen™ threadripper™ pro 3000 wx-series processors
- amd:amd ryzen™ threadripper™ pro 5000 wx-series processors
Attack patterns (CAPEC)
- CAPEC-176 Configuration/Environment Manipulation Severity: Medium
- CAPEC-680 Exploitation of Improperly Controlled Registers Likelihood: Medium · Severity: High
The attack patterns MITRE's CAPEC relates to this record's weaknesses, as MITRE names them. Credits.