PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-21944 AMD CVE debrief

CVE-2024-21944 is a medium-severity vulnerability (CVSS Score: 5.3) that involves improper input validation for DIMM serial presence detect (SPD) metadata. This vulnerability could potentially allow an attacker with physical access, ring0 access on a system with a non-compliant DIMM, or control over the Root of Trust for BIOS update, to overwrite guest memory, resulting in loss of guest data integrity.

Vendor
AMD
Product
AMD EPYC™ 7003 Series Processors
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-10
Original CVE updated
2026-06-11
Advisory published
2026-06-10
Advisory updated
2026-06-11

Who should care

Administrators and users of systems with DIMMs, especially those with non-compliant DIMMs or where an attacker might have physical access or control over the Root of Trust for BIOS updates.

Technical summary

The vulnerability is due to improper input validation for DIMM SPD metadata. This could allow an attacker under specific conditions to overwrite guest memory, impacting data integrity.

Defensive priority

MEDIUM

Recommended defensive actions

  • Review and apply BIOS updates as recommended by the vendor.
  • Ensure physical security of systems.
  • Validate and monitor DIMM compliance.

Evidence notes

Vendor evidence suggests AMD is the affected vendor.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-21944 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-21944

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-21944 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-21944

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.