CVE-2024-36326 - Vulnerability Details - OpenCVE

Missing authorization in AMD RomArmor could allow an attacker to bypass ROMArmor protections during system resume from a standby state, potentially resulting in a loss of confidentiality and integrity.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Amd	Ryzen Ryzen 7040 Ryzen Ai 300

No data.

No data.

References

Link	Providers
https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-4012.html

History

Mon, 08 Sep 2025 15:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Amd Amd ryzen Amd ryzen 7040 Amd ryzen Ai 300
Vendors & Products		Amd Amd ryzen Amd ryzen 7040 Amd ryzen Ai 300

Mon, 08 Sep 2025 15:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Sat, 06 Sep 2025 17:30:00 +0000

Type	Values Removed	Values Added
Description		Missing authorization in AMD RomArmor could allow an attacker to bypass ROMArmor protections during system resume from a standby state, potentially resulting in a loss of confidentiality and integrity.
Weaknesses		CWE-862
References		https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-4012.html
Metrics		cvssV3_1 `{'score': 8.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N'}`

MITRE

Status: PUBLISHED

Assigner: AMD

Published: 2025-09-06T17:25:46.065Z

Updated: 2025-09-09T03:55:23.262Z

Reserved: 2024-05-23T19:44:40.301Z

Link: CVE-2024-36326

Vulnrichment

Updated: 2025-09-08T14:50:45.277Z

NVD

Status : Awaiting Analysis

Published: 2025-09-06T18:15:39.457

Modified: 2025-09-08T16:25:38.810

Link: CVE-2024-36326

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-36326", "assignerOrgId": "b58fc414-a1e4-4f92-9d70-1add41838648", "state": "PUBLISHED", "assignerShortName": "AMD", "dateReserved": "2024-05-23T19:44:40.301Z", "datePublished": "2025-09-06T17:25:46.065Z", "dateUpdated": "2025-09-09T03:55:23.262Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b58fc414-a1e4-4f92-9d70-1add41838648", "shortName": "AMD", "dateUpdated": "2025-09-06T17:25:46.065Z"}, "affected": [{"defaultStatus": "affected", "vendor": "AMD", "product": "AMD Ryzen\u2122 7040 Series Mobile Processors with Radeon\u2122 Graphics", "versions": [{"version": "PhoenixPI-FP8-FP7_1.1.8.0", "status": "unaffected"}]}, {"defaultStatus": "affected", "vendor": "AMD", "product": "AMD Ryzen\u2122 AI 300 Series Processors", "versions": [{"version": "StrixKrackanPI-FP8_1.1.0.0", "status": "unaffected"}]}], "datePublic": "2025-09-06T17:05:01.015Z", "descriptions": [{"lang": "en", "value": "Missing authorization in AMD RomArmor could allow an attacker to bypass ROMArmor protections during system resume from a standby state, potentially resulting in a loss of confidentiality and integrity.", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Missing authorization in AMD RomArmor could allow an attacker to bypass ROMArmor protections during system resume from a standby state, potentially resulting in a loss of confidentiality and integrity.<br>"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "CWE-862 Missing Authorization", "lang": "en", "type": "CWE"}]}], "references": [{"url": "https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-4012.html"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "AMD PSIRT Automation 1.0"}, "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE", "baseScore": 8.4, "baseSeverity": "HIGH"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-08T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2024-36326"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-09T03:55:23.262Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-36326", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-09-08T14:50:41.414959Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-08T14:50:45.277Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "AMD", "product": "AMD Ryzen\u2122 7040 Series Mobile Processors with Radeon\u2122 Graphics", "versions": [{"status": "unaffected", "version": "PhoenixPI-FP8-FP7_1.1.8.0"}], "defaultStatus": "affected"}, {"vendor": "AMD", "product": "AMD Ryzen\u2122 AI 300 Series Processors", "versions": [{"status": "unaffected", "version": "StrixKrackanPI-FP8_1.1.0.0"}], "defaultStatus": "affected"}], "datePublic": "2025-09-06T17:05:01.015Z", "references": [{"url": "https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-4012.html"}], "x_generator": {"engine": "AMD PSIRT Automation 1.0"}, "descriptions": [{"lang": "en", "value": "Missing authorization in AMD RomArmor could allow an attacker to bypass ROMArmor protections during system resume from a standby state, potentially resulting in a loss of confidentiality and integrity.", "supportingMedia": [{"type": "text/html", "value": "Missing authorization in AMD RomArmor could allow an attacker to bypass ROMArmor protections during system resume from a standby state, potentially resulting in a loss of confidentiality and integrity.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b58fc414-a1e4-4f92-9d70-1add41838648", "shortName": "AMD", "dateUpdated": "2025-09-06T17:25:46.065Z"}}}, "cveMetadata": {"cveId": "CVE-2024-36326", "state": "PUBLISHED", "dateUpdated": "2025-09-08T14:50:48.261Z", "dateReserved": "2024-05-23T19:44:40.301Z", "assignerOrgId": "b58fc414-a1e4-4f92-9d70-1add41838648", "datePublished": "2025-09-06T17:25:46.065Z", "assignerShortName": "AMD"}, "dataVersion": "5.1"}