{"id":"CVE-2024-36315","aliases":["EUVD-2024-55576","GHSA-48h8-ccw7-958p","UBUNTU-CVE-2024-36315"],"status":"published","title":"Improper enforcement of the LFENCE serialization property may allow an attacker to bypass...","description":"Improper enforcement of the LFENCE serialization property may allow an attacker to bypass speculation barriers and potentially disclose sensitive information, potentially resulting in loss of confidentiality.","severity":{"version":"4.0","score":5.7,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00135,"percentile":0.03035,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-693"],"published":"2026-05-13T03:07:34Z","modified":"2026-10-27T18:31:15Z","fixes":[{"ecosystem":"Ubuntu:24.04:LTS","package":"amd64-microcode","fixed_in":["3.20251202.1ubuntu0.24.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"amd64-microcode","fixed_in":["3.20251202.1ubuntu0.25.10.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"amd64-microcode","fixed_in":["3.20251202.1ubuntu1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"amd64-microcode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.20120910-3","2.20131007.1+really20130710.1","3.20180524.1~ubuntu0.14.04.1","3.20180524.1~ubuntu0.14.04.2+really20130710.1","3.20180524.1~ubuntu0.14.04.2+really20130710.1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"amd64-microcode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.20141028.1","2.20160316.1","3.20180524.1~ubuntu0.16.04.1","3.20180524.1~ubuntu0.16.04.2","3.20191021.1ubuntu0.16.04.1","3.20191021.1+really3.20180524.1~ubuntu0.16.04.2","3.20191021.1+really3.20180524.1~ubuntu0.16.04.2+esm1","3.20191021.1+really3.20180524.1~ubuntu0.16.04.2+esm2","3.20191021.1+really3.20180524.1~ubuntu0.16.04.2+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"amd64-microcode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.20160316.3","3.20171205.1","3.20180524.1~ubuntu0.18.04.1","3.20180524.1~ubuntu0.18.04.2","3.20191021.1ubuntu0.18.04.2","3.20191021.1+really3.20181128.1~ubuntu0.18.04.1","3.20191021.1+really3.20181128.1~ubuntu0.18.04.1+esm1","3.20191021.1+really3.20181128.1~ubuntu0.18.04.1+esm2","3.20191021.1+really3.20181128.1~ubuntu0.18.04.1+esm3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"amd64-microcode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.20181128.1ubuntu2","3.20191021.1ubuntu1","3.20191218.1ubuntu1","3.20191218.1ubuntu1.1","3.20191218.1ubuntu1.2","3.20191218.1ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"amd64-microcode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.20191218.1ubuntu2","3.20191218.1ubuntu2.1","3.20191218.1ubuntu2.2","3.20191218.1ubuntu2.3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"amd64-microcode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20251202.1ubuntu0.24.04.1"}]}],"versions":["3.20230808.1.1ubuntu1","3.20231019.1ubuntu1","3.20231019.1ubuntu2","3.20231019.1ubuntu2.1","3.20250311.1ubuntu0.24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"amd64-microcode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20251202.1ubuntu0.25.10.1"}]}],"versions":["3.20240820.1ubuntu1","3.20250311.1ubuntu1","3.20250708.1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"amd64-microcode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20251202.1ubuntu1"}]}],"versions":["3.20250708.1ubuntu1","3.20250708.1ubuntu2"]}],"products":[{"vendor":"amd","product":"amd epyc™ 8004 series processors"},{"vendor":"amd","product":"amd epyc™ embedded 8004 series processors"},{"vendor":"amd","product":"amd epyc™ embedded 9004 series processors (formerly codenamed \"bergamo\")"},{"vendor":"amd","product":"amd epyc™ embedded 9004 series processors (formerly codenamed \"genoa\")"},{"vendor":"amd","product":"amd epyc™ series 9004 processors"},{"vendor":"amd","product":"amd epyc™series 4004 processors"},{"vendor":"amd","product":"amd instinct™ mi300a series processors"},{"vendor":"amd","product":"amd ryzen™ 7000 series desktop processors"},{"vendor":"amd","product":"amd ryzen™ 7000 series desktop processors (formerly codenamed \"raphael\")"},{"vendor":"amd","product":"amd ryzen™ 7040 series mobile processors with radeon™ graphics"},{"vendor":"amd","product":"amd ryzen™ 7045 series mobile processors with radeon™ graphics"},{"vendor":"amd","product":"amd ryzen™ 8000 series desktop processors"},{"vendor":"amd","product":"amd ryzen™ 8000 series desktop processors (formerly codenamed \"phoenix\")"},{"vendor":"amd","product":"amd ryzen™ 9000 series desktop processors"},{"vendor":"amd","product":"amd ryzen™ embedded 7000 series processors"},{"vendor":"amd","product":"amd ryzen™ embedded 8000 series processors"},{"vendor":"amd","product":"amd ryzen™ z1 series processors"}],"references":[{"url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3030.html","tags":["report"]},{"url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-4017.html","tags":["report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36315"},{"url":"https://github.com/advisories/GHSA-48h8-ccw7-958p"},{"url":"https://ubuntu.com/security/CVE-2024-36315","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-36315","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-36315","description":"Improper enforcement of the LFENCE serialization property may allow an attacker to bypass speculation barriers and potentially disclose sensitive information, potentially resulting in loss of confidentiality.","status":"published","published":"2026-05-13T03:07:34.076Z","modified":"2026-05-13T14:36:26.409Z","cvss":[{"version":"4.0","score":5.7,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-693"],"updated_at":"2026-11-02T14:34:14.649724Z"}],"euvd":[{"id":"EUVD-2024-55576","description":"Improper enforcement of the LFENCE serialization property may allow an attacker to bypass speculation barriers and potentially disclose sensitive information, potentially resulting in loss of confidentiality.","status":"published","published":"2026-05-13T03:07:34Z","modified":"2026-05-13T14:36:26Z","cvss":[{"version":"4.0","score":5.7,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T19:04:33.75998Z"}],"ghsa":[{"id":"GHSA-48h8-ccw7-958p","title":"Improper enforcement of the LFENCE serialization property may allow an attacker to bypass...","description":"Improper enforcement of the LFENCE serialization property may allow an attacker to bypass speculation barriers and potentially disclose sensitive information, potentially resulting in loss of confidentiality.","status":"published","published":"2026-10-27T18:31:07Z","modified":"2026-10-27T18:31:15Z","cvss":[{"version":"4.0","score":5.7,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"cwes":["CWE-693"],"updated_at":"2026-11-02T15:14:30.115077Z"}],"nvd":[{"id":"CVE-2024-36315","description":"Improper enforcement of the LFENCE serialization property may allow an attacker to bypass speculation barriers and potentially disclose sensitive information, potentially resulting in loss of confidentiality.","status":"published","published":"2026-05-13T04:16:43.977Z","modified":"2026-10-27T18:10:00.13Z","cvss":[{"version":"4.0","score":5.7,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-693"],"updated_at":"2026-11-02T14:10:47.77313Z"}],"osv":[{"id":"UBUNTU-CVE-2024-36315","description":"Improper enforcement of the LFENCE serialization property may allow an attacker to bypass speculation barriers and potentially disclose sensitive information, potentially resulting in loss of confidentiality.","status":"published","published":"2026-05-13T04:16:00Z","modified":"2026-09-23T23:16:29Z","cvss":[{"version":"4.0","score":5.7,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:54:50.784131Z"}]}}