Medium severity · published Jul 8, 2025
CVE-2024-36357
A transient execution vulnerability in some AMD processors may allow an attacker to infer data in the L1D cache, potentially resulting in the leakage of sensitive information…
5.6
CVSS
0.4%
EPSS
No
On KEV
Description
A transient execution vulnerability in some AMD processors may allow an attacker to infer data in the L1D cache, potentially resulting in the leakage of sensitive information across privileged boundaries.
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
Attack vector
Local
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AE
AMD EPYC™ 7003 Series Processors · AMD
All versions, or not specified · source: vendor
AE
AMD EPYC™ 8004 Series Processors · AMD
All versions, or not specified · source: vendor
AE
AMD EPYC™ 9004 Series Processors · AMD
All versions, or not specified · source: vendor
AE
AMD EPYC™ 9V64H Processor · AMD
All versions, or not specified · source: vendor
AE
AMD EPYC™ Embedded 7003 Series Processors · AMD
All versions, or not specified · source: vendor
AE
AMD EPYC™ Embedded 8004 Series Processors · AMD
All versions, or not specified · source: vendor
AE
AMD EPYC™ Embedded 9004 Series Processors · AMD
All versions, or not specified · source: vendor
AE
AMD EPYC™ Embedded 97X4 · AMD
All versions, or not specified · source: vendor
AR
AMD Ryzen™ 5000 Series Desktop Processor with Radeon™ Graphics · AMD
All versions, or not specified · source: vendor
AR
AMD Ryzen™ 5000 Series Desktop Processors · AMD
All versions, or not specified · source: vendor
AR
AMD Ryzen™ 5000 Series Processors with Radeon™ Graphics · AMD
All versions, or not specified · source: vendor
AR
AMD Ryzen™ 6000 Series Processor with Radeon™ Graphics · AMD
All versions, or not specified · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-36357
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-36357
www.amd.com
https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7029.html
www.openwall.com
http://www.openwall.com/lists/oss-security/2025/08/28/2
xenbits.xen.org
http://xenbits.xen.org/xsa/advisory-471.html
lists.debian.org
https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html
lists.debian.org
https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html
More from AMD EPYC™ 7003 Series Processors
8.7
CVE-2025-52533
Improper Access Control in an on-chip debug interface could allow a privileged attacker to enable a debug interface and potentially compromise data confidentiality or integrity
8.5
CVE-2026-0432
Incorrect default permissions in the installation directory for the AMD chipset driver could allow an attacker to achieve privilege escalation resulting in arbitrary code…
8.3
CVE-2023-31364
Improper handling of direct memory writes in the input-output memory management unit could allow a malicious guest virtual machine (VM) to flood a host with writes, potentially…
7.5
CVE-2025-54502
Incorrect use of boot service in the AMD Platform Configuration Blob (APCB) SMM driver could allow a privileged attacker with local access (Ring 0) to achieve privilege escalation…
7.5
CVE-2024-36354
Improper input validation for DIMM serial presence detect (SPD) metadata could allow an attacker with physical access, ring0 access on a system with a non-compliant DIMM, or…