CVE-2024-56721 x86/CPU/AMD: Terminate the erratum_1386_microcode array
A missing null terminator in an AMD CPU erratum array causes out-of-bounds reads, potentially leading to system crashes or information leaks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-56721?
CVE-2024-56721 is a high-severity memory corruption vulnerability in Linux kernel, published on 29 Dec 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
x86/CPU/AMD: Terminate the erratum_1386_microcode array
The erratum_1386_microcode array requires an empty entry at the end. Otherwise x86_match_cpu_with_stepping() will continue iterate the array after it ended.
Add an empty entry to erratum_1386_microcode to its end.
Weakness: CWE-125
Which versions are affected by CVE-2024-56721?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-56721?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2024-56721 being exploited?
There is no known exploitation of CVE-2024-56721 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2024-56721, DEBIAN-CVE-2024-56721, GHSA-4hrg-cvr4-ff8f, UBUNTU-CVE-2024-56721.