CVE-2024-21935 Path traversal in AMD Instinct™ MI300X
Privileged attackers can manipulate Redfish API commands to delete files from the root directory, causing data corruption on AMD Instinct MI300X accelerators.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-21935?
CVE-2024-21935 is a medium-severity path traversal vulnerability in AMD Instinct™ MI300X, published on 23 Sep 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Improper input validation in Satellite Management Controller (SMC) may allow an attacker with privileges to manipulate Redfish® API commands to remove files from the local root directory, potentially resulting in data corruption.
Weakness: CWE-241
Which versions are affected by CVE-2024-21935?
How do I fix CVE-2024-21935?
No fix has been published for CVE-2024-21935 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-21935 being exploited?
There is no known exploitation of CVE-2024-21935 in the wild and no public exploit code.
Sources
Also known as GHSA-pfx9-w6cc-q924.