CVE-2024-21924

HighCVSS 8.2/10Last modified Jun 17, 2026

Description

SMM callout vulnerability within the AmdPlatformRasSspSmm driver could allow a ring 0 attacker to modify boot services handlers, potentially resulting in arbitrary code execution.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-250

Affected software

No affected versions have been published.

Timeline

Published: Feb 11, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-219258.2Improper input validation within the AmdPspP2CmboxV2 driver may allow a privileged attacker to overwrite SMRAM, leading to arbitrary code ex CVE-2024-219275.0Improper input validation in Satellite Management Controller (SMC) may allow an attacker with privileges to use certain special characters i CVE-2024-21935.7A Speculative Race Condition (SRC) vulnerability that impacts modern CPU architectures supporting speculative execution (related to Spectre CVE-2024-219355.0Improper input validation in Satellite Management Controller (SMC) may allow an attacker with privileges to manipulate Redfish® API commands CVE-2024-219377.8Incorrect default permissions in the AMD HIP SDK installation directory could allow an attacker to achieve privilege escalation potentially CVE-2024-219387.8Incorrect default permissions in the AMD Management Plugin for the Microsoft® System Center Configuration Manager (SCCM) installation direct CVE-2024-219397.3Incorrect default permissions in the AMD Cloud Manageability Service (ACMS) Software installation directory could allow an attacker to achie CVE-2024-21947.2The WP Statistics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the URL search parameter in all versions up to, and CVE-2024-219445.3Improper input validation for DIMM serial presence detect (SPD) metadata could allow an attacker with physical access, ring0 access on a sys CVE-2024-219457.3Incorrect default permissions in the AMD RyzenTM Master monitoring SDK installation directory could allow an attacker to achieve privilege e CVE-2024-219467.3Incorrect default permissions in the AMD RyzenTM Master Utility installation directory could allow an attacker to achieve privilege escalati CVE-2024-219477.5Improper input validation in the system management mode (SMM) could allow a privileged attacker to overwrite arbitrary memory potentially re