Vulnerability DatabaseCVE-2024-56161

CVE-2024-56161:
Linux Debian vulnerability analysis and mitigation

Overview

A high-severity vulnerability (CVE-2024-56161) was discovered in AMD CPU ROM microcode patch loader affecting AMD's Zen-based processors (Zen 1 through Zen 4 CPUs). The vulnerability stems from an insecure hash function used in the signature validation for microcode updates. This flaw was discovered by Google security researchers and reported to AMD on September 25, 2024 (AMD Security Bulletin, Google Advisory).

Technical details

The vulnerability has been assigned a CVSS v3.1 score of 7.2 (High) with the vector string CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N. The flaw specifically affects the signature verification mechanism in the CPU ROM microcode patch loader. It involves an insecure hash function in the signature validation process for microcode updates, which could potentially allow for the crafting of malicious microcode patches (AMD Security Bulletin, NVD).

Impact

The vulnerability could lead to the compromise of confidential computing workloads protected by AMD Secure Encrypted Virtualization (SEV-SNP) and potentially compromise Dynamic Root of Trust Measurement. If successfully exploited, it could result in loss of confidentiality and integrity of confidential guests running under AMD SEV-SNP (Hacker News, AMD Security Bulletin).

Mitigation and workarounds

AMD has released a mitigation that requires updating microcode on all impacted platforms. Additionally, some platforms require an SEV firmware update to support SEV-SNP attestation. The fix involves updating the system BIOS image and rebooting the platform. Users can verify the mitigation through the SEV-SNP attestation report. The patches were initially released to customers on December 17, 2024 (AMD Security Bulletin).

Community reactions

Due to the deep supply chain implications, Google made an exception to their standard vulnerability disclosure policy, delaying full technical details until March 5, 2025, to give users adequate time to re-establish trust on their confidential-compute workloads. The vulnerability initially leaked through an Asus update page in January 2025, leading to early industry awareness before the official disclosure (TechTarget, Hacker News).