CVE-2024-56161
amd64-microcode - security update
Improper signature verification in AMD CPU ROM microcode patch loader may allow an attacker with local administrator privilege to load malicious CPU microcode resulting in loss of confidentiality and integrity of a confidential guest running under AMD SEV-SNP.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Improper signature verification in AMD CPU ROM microcode patch loader may allow an attacker with local administrator privilege to load malicious CPU microcode resulting in loss of confidentiality and integrity of a confidential guest running under AMD SEV-SNP.
- Record
CVE-2024-56161- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N - Weakness
- CWE-347
- Updated
- 2026-11-02
EUVDEUVD-2024-52992
Improper signature verification in AMD CPU ROM microcode patch loader may allow an attacker with local administrator privilege to load malicious CPU microcode resulting in loss of confidentiality and integrity of a confidential guest running under AMD SEV-SNP.
- Record
EUVD-2024-52992- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N - Updated
- 2026-11-02
NVD
Improper signature verification in AMD CPU ROM microcode patch loader may allow an attacker with local administrator privilege to load malicious CPU microcode resulting in loss of confidentiality and integrity of a confidential guest running under AMD SEV-SNP.
- Record
CVE-2024-56161- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N - Weakness
- CWE-347
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2024-56161
Improper signature verification in AMD CPU ROM microcode patch loader may allow an attacker with local administrator privilege to load malicious CPU microcode resulting in loss of confidentiality and integrity of a confidential guest running under AMD SEV-SNP.
- Record
DEBIAN-CVE-2024-56161- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N - Updated
- 2026-11-02
OSVOESA-2025-1307
linux-firmware security update
This package contains firmware images required by some devices.
Security Fix(es):
Improper signature verification in AMD CPU ROM microcode patch loader may allow an attacker with local administrator privilege to load malicious CPU microcode resulting in loss of confidentiality and integrity of a confidential guest running under AMD SEV-SNP.(CVE-2024-56161)
- Record
OESA-2025-1307- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-56161
Improper signature verification in AMD CPU ROM microcode patch loader may allow an attacker with local administrator privilege to load malicious CPU microcode resulting in loss of confidentiality and integrity of a confidential guest running under AMD SEV-SNP.
- Record
UBUNTU-CVE-2024-56161- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N - Updated
- 2026-11-02
Show 5 moreShow less
OSV No score
Improper signature verification in AMD CPU ROM microcode patch loader may allow an attacker with local administrator privilege to load malicious CPU microcode resulting in loss of confidentiality and integrity of a confidential guest running under AMD SEV-SNP.
- Record
CVE-2024-56161- Updated
- 2026-11-02
OSVMGASA-2025-0124 No score
Updated microcode packages fix security vulnerability
Improper signature verification in AMD CPU ROM microcode patch loader may allow an attacker with local administrator privilege to load malicious CPU microcode resulting in loss of confidentiality and integrity of a confidential guest running under AMD SEV-SNP. (CVE-2024-56161)
- Record
MGASA-2025-0124- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11242-1 No score
spectre-meltdown-checker-26.36.0602723-1.1 on GA media
These are all security issues fixed in the spectre-meltdown-checker-26.36.0602723-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11242-1- Updated
- 2026-11-02
OSVUSN-7560-1 No score
amd64-microcode vulnerability
Josh Eads, Kristoffer Janke, Eduardo Nava, Tavis Ormandy and Matteo Rizzo discovered that AMD Microcode incorrectly verified signatures. An attacker with local administrator privilege could possibly use this issue to cause loss of confidentiality and integrity of a confidential guest running under AMD SEV-SNP.
- Record
USN-7560-1- Updated
- 2026-11-02
OSVUSN-7561-1 No score
amd64-microcode vulnerabilities
It was discovered that AMD Microcode incorrectly handled memory addresses. An attacker with local administrator privilege could possibly use this issue to cause loss of integrity of a confidential guest running under AMD SEV-SNP. (CVE-2023-20584, CVE-2023-31356)
Josh Eads, Kristoffer Janke, Eduardo Nava, Tavis Ormandy and Matteo Rizzo discovered that AMD Microcode incorrectly verified signatures. An attacker with local administrator privilege could possibly use this issue to cause loss of confidentiality and integrity of a confidential guest running under AMD SEV-SNP. (CVE-2024-56161)
- Record
USN-7561-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
amd64-microcodeDebian:12 |
before 3.20250311.1~deb12u1, plus listed versions 0.20120117-11.20120117-11.20120117-21.20120117-2~bpo60+11.20120910-1 Show 45 moreShow less1.20120910-1~bpo60+11.20120910-21.20120910-2~bpo60+11.20120910-31.20141028.11.20160316.12.20120910-12.20120910-1~bpo70+12.20131007.12.20131007.1+really20130710.12.20141028.12.20141028.1~bpo70+12.20160316.12.20160316.1~bpo70+12.20160316.1~deb8u13.20160316.13.20160316.23.20160316.33.20171205.13.20171205.23.20180515.13.20180524.13.20180524.1~bpo9+13.20181128.13.20181128.1~bpo9+13.20181128.1~deb8u13.20181128.1~deb9u13.20181128.1~deb9u23.20191021.13.20191218.13.20220411.13.20220411.23.20230414.13.20230719.13.20230719.1~deb10u13.20230719.1~deb11u13.20230719.1~deb12u13.20230808.13.20230808.1.13.20230808.1.1~deb11u13.20230808.1.1~deb12u13.20230823.13.20231019.13.20240116.23.20240116.2+nmu1 |
3.20250311.1~deb12u1 |
amd64-microcodeDebian:13 |
before 3.20250311.1, plus listed versions 0.20120117-11.20120117-11.20120117-21.20120117-2~bpo60+11.20120910-1 Show 45 moreShow less1.20120910-1~bpo60+11.20120910-21.20120910-2~bpo60+11.20120910-31.20141028.11.20160316.12.20120910-12.20120910-1~bpo70+12.20131007.12.20131007.1+really20130710.12.20141028.12.20141028.1~bpo70+12.20160316.12.20160316.1~bpo70+12.20160316.1~deb8u13.20160316.13.20160316.23.20160316.33.20171205.13.20171205.23.20180515.13.20180524.13.20180524.1~bpo9+13.20181128.13.20181128.1~bpo9+13.20181128.1~deb8u13.20181128.1~deb9u13.20181128.1~deb9u23.20191021.13.20191218.13.20220411.13.20220411.23.20230414.13.20230719.13.20230719.1~deb10u13.20230719.1~deb11u13.20230719.1~deb12u13.20230808.13.20230808.1.13.20230808.1.1~deb11u13.20230808.1.1~deb12u13.20230823.13.20231019.13.20240116.23.20240116.2+nmu1 |
3.20250311.1 |
amd64-microcodeDebian:14 |
before 3.20250311.1, plus listed versions 0.20120117-11.20120117-11.20120117-21.20120117-2~bpo60+11.20120910-1 Show 45 moreShow less1.20120910-1~bpo60+11.20120910-21.20120910-2~bpo60+11.20120910-31.20141028.11.20160316.12.20120910-12.20120910-1~bpo70+12.20131007.12.20131007.1+really20130710.12.20141028.12.20141028.1~bpo70+12.20160316.12.20160316.1~bpo70+12.20160316.1~deb8u13.20160316.13.20160316.23.20160316.33.20171205.13.20171205.23.20180515.13.20180524.13.20180524.1~bpo9+13.20181128.13.20181128.1~bpo9+13.20181128.1~deb8u13.20181128.1~deb9u13.20181128.1~deb9u23.20191021.13.20191218.13.20220411.13.20220411.23.20230414.13.20230719.13.20230719.1~deb10u13.20230719.1~deb11u13.20230719.1~deb12u13.20230808.13.20230808.1.13.20230808.1.1~deb11u13.20230808.1.1~deb12u13.20230823.13.20231019.13.20240116.23.20240116.2+nmu1 |
3.20250311.1 |
amd64-microcodeDebian:11 |
before 3.20250311.1~deb11u1, plus listed versions 0.20120117-11.20120117-11.20120117-21.20120117-2~bpo60+11.20120910-1 Show 45 moreShow less1.20120910-1~bpo60+11.20120910-21.20120910-2~bpo60+11.20120910-31.20141028.11.20160316.12.20120910-12.20120910-1~bpo70+12.20131007.12.20131007.1+really20130710.12.20141028.12.20141028.1~bpo70+12.20160316.12.20160316.1~bpo70+12.20160316.1~deb8u13.20160316.13.20160316.23.20160316.33.20171205.13.20171205.23.20180515.13.20180524.13.20180524.1~bpo9+13.20181128.13.20181128.1~bpo9+13.20181128.1~deb8u13.20181128.1~deb9u13.20181128.1~deb9u23.20191021.13.20191218.13.20220411.13.20220411.23.20230414.13.20230719.13.20230719.1~deb10u13.20230719.1~deb11u13.20230719.1~deb12u13.20230808.13.20230808.1.13.20230808.1.1~deb11u13.20230808.1.1~deb12u13.20230823.13.20231019.13.20240116.23.20240116.2+nmu1 |
3.20250311.1~deb11u1 |
microcodeMageia:9 |
before 0.20250211-2.mga9.nonfree | 0.20250211-2.mga9.nonfree |
linux-firmwareopenEuler:22.03-LTS-SP3 |
before 20250311-1.oe2203sp3 | 20250311-1.oe2203sp3 |
linux-firmwareopenEuler:22.03-LTS-SP4 |
before 20250311-1.oe2203sp4 | 20250311-1.oe2203sp4 |
linux-firmwareopenEuler:24.03-LTS |
before 20250311-1.oe2403sp1 | 20250311-1.oe2403sp1 |
linux-firmwareopenEuler:24.03-LTS-SP1 |
before 20250311-1.oe2403sp1 | 20250311-1.oe2403sp1 |
linux-firmwareopenEuler:20.03-LTS-SP4 |
before 20250311-1.oe2003sp4 | 20250311-1.oe2003sp4 |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
amd64-microcodeUbuntu:24.04:LTS |
before 3.20250311.1ubuntu0.24.04.1, plus listed versions 3.20230808.1.1ubuntu13.20231019.1ubuntu13.20231019.1ubuntu23.20231019.1ubuntu2.1 |
3.20250311.1ubuntu0.24.04.1 |
amd64-microcodeUbuntu:25.04 |
before 3.20250311.1ubuntu0.25.04.1, plus listed versions 3.20240116.2+nmu1ubuntu13.20240116.2+nmu1ubuntu1.13.20240820.1ubuntu1 |
3.20250311.1ubuntu0.25.04.1 |
amd64-microcodeUbuntu:24.04:LTS From an advisory covering 3 CVEs |
before 3.20250311.1ubuntu0.24.04.1, plus listed versions 3.20230808.1.1ubuntu13.20231019.1ubuntu13.20231019.1ubuntu23.20231019.1ubuntu2.1 |
3.20250311.1ubuntu0.24.04.1 |
spectre-meltdown-checkeropenSUSE:Tumbleweed From an advisory covering 28 CVEs |
before 26.36.0602723-1.1 | 26.36.0602723-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-56161 is a high vulnerability (CVSS 7.2) in Amd Epyc™ 7001 Series, published February 3, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.53%, the 45th percentile. Fixed in amd64-microcode 3.20250311.1~deb12u1.
References
amd.com/en/resources/product-security/bulletin/amd-sb-3019.html
openwall.com/lists/oss-security/2025/02/04/1
lists.debian.org/debian-lts-announce/2025/03/msg00024.html
security-tracker.debian.org/tracker/CVE-2024-56161
Show 41 moreShow less
advisories.mageia.org/MGASA-2025-0124.html
bugs.mageia.org/show_bug.cgi?id=34149
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2025-1307
nvd.nist.gov/vuln/detail/CVE-2024-56161
ubuntu.com/security/CVE-2024-56161
cve.org/CVERecord?id=CVE-2024-56161
github.com/google/security-research/security/advisories/GHSA-4xq7-4mgh-gp6w
bughunters.google.com/blog/5424842357473280/zen-and-the-art-of-microcode-hacking
bugs.debian.org/cgi-bin/bugreport.cgi?bug=1099830
suse.com/security/cve/CVE-2017-5715
Left out here: 33 versions. The JSON record has them.