CVE-2024-36309

MediumCVSS 4.6/10Last modified Nov 13, 2026

Description

Missing Lock Bit Protection in the Northbridge IO (NBIO) could allow a privileged attacker to use an intentionally disabled device as part of a remapping attack potentially impacting data confidentiality, integrity, or availability.

Metrics

CVSS 4.0 4.6/10CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
AMDAMD EPYC™ 9004 Series Processors—
AMDAMD EPYC™ 7003 Series Processors—
AMDAMD EPYC™ 7002 Series Processors—
AMDAMD EPYC™ 7001 Series Processors—
AMDAMD EPYC™ 4004 Series Processors—
AMDAMD EPYC™ 9005 Series Processors—
AMDAMD Instinct™ MI300A Series Processors—
AMDAMD EPYC™ 4005 Series Processors—
AMDAMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics—
AMDAMD Ryzen™ 7035 Series Processors with Radeon™ Graphics—
AMDAMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics—
AMDAMD Ryzen™ 7040 Series Mobile Processors with Radeon™ Graphics—
AMDAMD Ryzen™ 7020 Series Processors with Radeon™ Graphics—
AMDAMD Ryzen™ 7045 Series Mobile Processors with Radeon™ Graphics—
AMDAMD Ryzen™ 7000 Series Desktop Processors—
AMDAMD Ryzen™ 3000 Series Desktop Processors—
AMDAMD Ryzen™ Threadripper™ PRO 3000 WX-Series Processors—
AMDAMD Ryzen™ 7030 Series Mobile Processors with Radeon™ Graphics—
AMDAMD Ryzen™ Threadripper™ 3000 Processors—
AMDAMD Ryzen™ AI 300 Series Processors—
AMDAMD Ryzen™ Threadripper™ PRO 5000 WX-Series Processors—
AMDAMD Ryzen™ Threadripper™ 7000 Processors—
AMDAMD Ryzen™ Threadripper™ PRO 7000 WX-Series Processors—
AMDAMD Ryzen™ Threadripper™ PRO 7000 WX-Series Processors—
AMDAMD Ryzen™ 7000 Series Desktop Processors—
AMDAMD Ryzen™ 8000 Series Desktop Processors—
AMDAMD Ryzen™ 8000 Series Desktop Processors—
AMDAMD Ryzen™ 9000 Series Desktop Processors—
AMDAMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics—
AMDAMD Ryzen™ 4000 Series Desktop Processors—
AMDAMD Ryzen™ 5000 Series Desktop Processors—
AMDAMD Ryzen™ 5000 Series Desktop Processors with Radeon™ Graphics—
AMDAMD Ryzen™ 3000 Series Desktop Processors—
AMDAMD Ryzen™ 8040 Series Mobile Processors with Radeon™ Graphics—
AMDAMD Ryzen™ 3000 Series Mobile Processors with Radeon™ Graphics—
AMDAMD Ryzen™ 6000 Series Processors with Radeon™ Graphics—
AMDAMD Ryzen™ AI Max 300 Series Processors—
AMDAMD Ryzen™ 9000HX Series Mobile Processors—
AMDAMD EPYC™ Embedded 3000 Series Processors—
AMDAMD EPYC™ Embedded 4005 Series Processors—
AMDAMD EPYC™ Embedded 7002 Series Processors—
AMDAMD EPYC™ Embedded 7003 Series Processors—
AMDAMD EPYC™ Embedded 8004 Series Processors—
AMDAMD EPYC™ Embedded 9004 Series Processors - Genoa—
AMDAMD EPYC™ Embedded 9004 Series Processors - Bergamo—
AMDAMD EPYC™ Embedded 9005 Series Processors—
AMDAMD Ryzen™ Embedded 5000 Series Processors—
AMDAMD Ryzen™ Embedded 7000 Series Processors—
AMDAMD Ryzen™ Embedded 8000 Series Processors—
AMDAMD Ryzen™ Embedded 9000 Series Processors—

References

Timeline

Published
Nov 10, 2026
Last modified
Nov 13, 2026
NVD status
Awaiting Analysis

Related CVEs from 2024

CVE-2024-36314.3The HL Twitter WordPress plugin through 2014.1.18 does not have CSRF check when unlinking twitter accounts, which could allow attackers to mCVE-2024-363104.6Improper input validation in the SMM communications buffer could allow a privileged attacker to perform an out of bounds read or write to SMCVE-2024-363114.6A Time-of-check time-of-use (TOCTOU) race condition in the SMM communications buffer could allow a privileged attacker to bypass input validCVE-2024-363155.7Improper enforcement of the LFENCE serialization property may allow an attacker to bypass speculation barriers and potentially disclose sensCVE-2024-363165.5The integer overflow vulnerability within AMD Graphics driver could allow an attacker to bypass size checks potentially resulting in a deniaCVE-2024-363196.3Debug code left active in AMD's Video Decoder Engine Firmware (VCN FW) could allow a attacker to submit a maliciously crafted command causinCVE-2024-36326.8The Smart Image Gallery WordPress plugin before 1.0.19 does not have CSRF check in place when updating its settings, which could allow attacCVE-2024-363207.0Integer Overflow within atihdwt6.sys can allow a local attacker to cause out of bound read/write potentially leading to loss of confidentialCVE-2024-363217.3Unquoted search path within AIM-T Manageability Service can allow a local attacker to escalate privileges, potentially resulting in arbitrarCVE-2024-363238.8Improper isolation of VCN-JPEG HW register space could allow a malicious Guest Virtual Machine (VM) or a process to perform unauthorized accCVE-2024-363248.8Improper input validation in AMD Graphics Driver could allow an attacker to supply a specially crafted pointer, potentially leading to arbitCVE-2024-363268.4Missing authorization in AMD RomArmor could allow an attacker to bypass ROMArmor protections during system resume from a standby state, pote
CVE-2024-36309: Medium severity, CVSS 4.6 | Vulnix