CVE-2024-21978

HighCVSS 7.9/10Last modified Jun 17, 2026

Description

Improper input validation in SEV-SNP could allow a malicious hypervisor to read or overwrite guest memory potentially leading to data leakage or data corruption.

Metrics

CVSS 3.1 7.9/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
AMD	3rd Gen AMD EPYC™ Processors	>= various, < MilanPI 1.0.0.D
AMD	4th Gen AMD EPYC™ Processors	>= various, < GenoaPI 1.0.0.C
AMD	AMD EPYC™ Embedded 7003	>= various, < EmbMilanPI-SP3 1.0.0.9
AMD	AMD EPYC™ Embedded 9003	>= various, < EmbGenoaPI-SP5 1.0.0.7
amd	epyc_7003_firmware	< milanpi_1.0.0.9_sp3
amd	epyc_9003_firmware	< genoapi_1.0.0.7_sp5
amd	epyc_7773x_firmware	< milanpi_1.0.0.d
amd	epyc_9754s_firmware	< genoapi_1.0.0.c

References

https://https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3011.htmlBroken Link

Timeline

Published: Aug 5, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-219795.3An out of bounds write vulnerability in the AMD Radeon™ user mode driver for DirectX® 11 could allow an attacker with access to a malformed CVE-2024-21986.1The Contact Form by BestWebSoft plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘cntctfrm_contact_address’ para CVE-2024-219807.9Improper restriction of write operations in SNP firmware could allow a malicious hypervisor to potentially overwrite a guest's memory or UMC CVE-2024-219815.7Improper key usage control in AMD Secure Processor (ASP) may allow an attacker with local access who has gained arbitrary code execution pri CVE-2024-219826.5ONTAP versions 9.4 and higher are susceptible to a vulnerability which when successfully exploited could lead to disclosure of sensitive i CVE-2024-219836.5StorageGRID (formerly StorageGRID Webscale) versions prior to 11.8 are susceptible to a Denial of Service (DoS) vulnerability. Successful CVE-2024-219846.9StorageGRID (formerly StorageGRID Webscale) versions prior to 11.8 are susceptible to a difficult to exploit Reflected Cross-Site Scripting CVE-2024-219857.6ONTAP 9 versions prior to 9.9.1P18, 9.10.1P16, 9.11.1P13, 9.12.1P10 and 9.13.1P4 are susceptible to a vulnerability which could allow an a CVE-2024-219875.4SnapCenter versions 4.8 prior to 5.0 are susceptible to a vulnerability which could allow an authenticated SnapCenter Server user to modif CVE-2024-219885.3StorageGRID (formerly StorageGRID Webscale) versions prior to 11.7.0.9 and 11.8.0.5 are susceptible to disclosure of sensitive information CVE-2024-219898.8ONTAP Select Deploy administration utility versions 9.12.1.x, 9.13.1.x and 9.14.1.x are susceptible to a vulnerability which when successf CVE-2024-21995.7A denial of service vulnerability was found in 389-ds-base ldap server. This issue may allow an authenticated user to cause a server crash w