CVE-2024-36331 - Vulnerability Details - OpenCVE

ReportizFlow

Improper initialization of CPU cache memory could allow a privileged attacker with hypervisor access to overwrite SEV-SNP guest memory resulting in loss of data integrity.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Amd	Epyc Epyc 9004 Epyc Embedded 9004

No data.

No data.

References

Link	Providers
https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3014.html
https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-5007.html

History

Mon, 08 Sep 2025 15:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Amd Amd epyc Amd epyc 9004 Amd epyc Embedded 9004
Vendors & Products		Amd Amd epyc Amd epyc 9004 Amd epyc Embedded 9004

Mon, 08 Sep 2025 15:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sat, 06 Sep 2025 17:45:00 +0000

Type	Values Removed	Values Added
Description		Improper initialization of CPU cache memory could allow a privileged attacker with hypervisor access to overwrite SEV-SNP guest memory resulting in loss of data integrity.
Weaknesses		CWE-665
References		https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3014.html https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-5007.html
Metrics		cvssV3_1 `{'score': 3.2, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N'}`

MITRE

Status: PUBLISHED

Assigner: AMD

Published: 2025-09-06T17:29:38.215Z

Updated: 2025-09-08T14:50:13.442Z

Reserved: 2024-05-23T19:44:44.387Z

Link: CVE-2024-36331

Vulnrichment

Updated: 2025-09-08T14:50:09.164Z

NVD

Status : Awaiting Analysis

Published: 2025-09-06T18:15:39.623

Modified: 2025-09-08T16:25:38.810

Link: CVE-2024-36331

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-36331", "assignerOrgId": "b58fc414-a1e4-4f92-9d70-1add41838648", "state": "PUBLISHED", "assignerShortName": "AMD", "dateReserved": "2024-05-23T19:44:44.387Z", "datePublished": "2025-09-06T17:29:38.215Z", "dateUpdated": "2025-09-08T14:50:13.442Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b58fc414-a1e4-4f92-9d70-1add41838648", "shortName": "AMD", "dateUpdated": "2025-09-06T17:29:38.215Z"}, "affected": [{"defaultStatus": "affected", "vendor": "AMD", "product": "AMD EPYC\u2122 9004 Series Processors", "versions": [{"version": "GenoaPI_1.0.0.F", "status": "unaffected"}]}, {"defaultStatus": "affected", "vendor": "AMD", "product": "EPYC\u2122 Embedded 9004 Series Processors", "versions": [{"version": "EmbGenoaPI-1.0.0.A", "status": "unaffected"}]}, {"defaultStatus": "affected", "vendor": "AMD", "product": "AMD EPYC\u2122 Embedded 9004 Series Processors", "versions": [{"version": "EmbGenoaPI-1.0.0.A", "status": "unaffected"}]}], "datePublic": "2025-09-06T17:09:00.562Z", "descriptions": [{"lang": "en", "value": "Improper initialization of CPU cache memory could allow a privileged attacker with hypervisor access to overwrite SEV-SNP guest memory resulting in loss of data integrity.", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Improper initialization of CPU cache memory could allow a privileged attacker with hypervisor access to overwrite SEV-SNP guest memory resulting in loss of data integrity.<br>"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-665", "description": "CWE-665 Improper Initialization", "lang": "en", "type": "CWE"}]}], "references": [{"url": "https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-5007.html"}, {"url": "https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3014.html"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "AMD PSIRT Automation 1.0"}, "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseScore": 3.2, "baseSeverity": "LOW"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-08T14:50:05.457904Z", "id": "CVE-2024-36331", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-08T14:50:13.442Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-36331", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-08T14:50:05.457904Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-08T14:50:09.164Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 3.2, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "AMD", "product": "AMD EPYC\u2122 9004 Series Processors", "versions": [{"status": "unaffected", "version": "GenoaPI_1.0.0.F"}], "defaultStatus": "affected"}, {"vendor": "AMD", "product": "EPYC\u2122 Embedded 9004 Series Processors", "versions": [{"status": "unaffected", "version": "EmbGenoaPI-1.0.0.A"}], "defaultStatus": "affected"}, {"vendor": "AMD", "product": "AMD EPYC\u2122 Embedded 9004 Series Processors", "versions": [{"status": "unaffected", "version": "EmbGenoaPI-1.0.0.A"}], "defaultStatus": "affected"}], "datePublic": "2025-09-06T17:09:00.562Z", "references": [{"url": "https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-5007.html"}, {"url": "https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3014.html"}], "x_generator": {"engine": "AMD PSIRT Automation 1.0"}, "descriptions": [{"lang": "en", "value": "Improper initialization of CPU cache memory could allow a privileged attacker with hypervisor access to overwrite SEV-SNP guest memory resulting in loss of data integrity.", "supportingMedia": [{"type": "text/html", "value": "Improper initialization of CPU cache memory could allow a privileged attacker with hypervisor access to overwrite SEV-SNP guest memory resulting in loss of data integrity.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-665", "description": "CWE-665 Improper Initialization"}]}], "providerMetadata": {"orgId": "b58fc414-a1e4-4f92-9d70-1add41838648", "shortName": "AMD", "dateUpdated": "2025-09-06T17:29:38.215Z"}}}, "cveMetadata": {"cveId": "CVE-2024-36331", "state": "PUBLISHED", "dateUpdated": "2025-09-08T14:50:13.442Z", "dateReserved": "2024-05-23T19:44:44.387Z", "assignerOrgId": "b58fc414-a1e4-4f92-9d70-1add41838648", "datePublished": "2025-09-06T17:29:38.215Z", "assignerShortName": "AMD"}, "dataVersion": "5.1"}