CVE-2024-36350 Information disclosure in AMD EPYC™ 7003 Series Processors
Transient execution flaw in AMD processors allows attackers to infer data from previous stores, leaking privileged information.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-36350?
CVE-2024-36350 is a medium-severity vulnerability in AMD EPYC™ 7003 Series Processors, published on 8 Jul 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A transient execution vulnerability in some AMD processors may allow an attacker to infer data from previous stores, potentially resulting in the leakage of privileged information.
Weakness: CWE-1421
Which versions are affected by CVE-2024-36350?
Linux distribution packages (17)
iwl100-firmware Red Hat:enterprise_linux:9::baseos | All versions | 0:39.31.5.1-151.3.el9_6 |
iwl1000-firmware Red Hat:enterprise_linux:9::baseos | All versions | 1:39.31.5.1-151.3.el9_6 |
iwl105-firmware Red Hat:enterprise_linux:9::baseos | All versions | 0:18.168.6.1-151.3.el9_6 |
iwl135-firmware Red Hat:enterprise_linux:9::baseos | All versions | 0:18.168.6.1-151.3.el9_6 |
iwl2000-firmware Red Hat:enterprise_linux:9::baseos | All versions | 0:18.168.6.1-151.3.el9_6 |
iwl2030-firmware Red Hat:enterprise_linux:9::baseos | All versions | 0:18.168.6.1-151.3.el9_6 |
iwl3160-firmware Red Hat:enterprise_linux:9::baseos | All versions | 1:25.30.13.0-151.3.el9_6 |
iwl5000-firmware Red Hat:enterprise_linux:9::baseos | All versions | 0:8.83.5.1_1-151.3.el9_6 |
iwl5150-firmware Red Hat:enterprise_linux:9::baseos | All versions | 0:8.24.2.2-151.3.el9_6 |
iwl6000g2a-firmware Red Hat:enterprise_linux:9::baseos | All versions | 0:18.168.6.1-151.3.el9_6 |
iwl6000g2b-firmware Red Hat:enterprise_linux:9::baseos | All versions | 0:18.168.6.1-151.3.el9_6 |
iwl6050-firmware Red Hat:enterprise_linux:9::baseos | All versions | 0:41.28.5.1-151.3.el9_6 |
iwl7260-firmware Red Hat:enterprise_linux:9::baseos | All versions | 1:25.30.13.0-151.3.el9_6 |
libertas-sd8787-firmware Red Hat:enterprise_linux:9::baseos | All versions | 0:20250716-151.3.el9_6 |
linux-firmware Red Hat:enterprise_linux:9::baseos | All versions | 0:20250716-151.3.el9_6 |
linux-firmware-whence Red Hat:enterprise_linux:9::baseos | All versions | 0:20250716-151.3.el9_6 |
netronome-firmware Red Hat:enterprise_linux:9::baseos | All versions | 0:20250716-151.3.el9_6 |
How do I fix CVE-2024-36350?
Apply the vendor's patch.
Is CVE-2024-36350 being exploited?
There is no known exploitation of CVE-2024-36350 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2024-36350, DEBIAN-CVE-2024-36350, GHSA-3q6p-m26m-f78r, RHBA-2025:12877, ROOT-OS-DEBIAN-11-CVE-2024-36350, ROOT-OS-DEBIAN-12-CVE-2024-36350 and 3 more.