CVE-2024-36350

A flaw was found in AMD processors. This transient execution vulnerability may allow an unprivileged local attacker to cause information disclosure of privileged data. By exploiting how the processor speculatively processes instructions ahead of time, an attacker can infer sensitive data from previous memory store operations that should remain protected.

This Moderate-impact transient execution vulnerability in some AMD processors affects the kernel, kernel-rt, and linux-firmware components of Red Hat Enterprise Linux. An unprivileged local attacker could exploit how the processor speculatively processes instructions ahead of time to infer sensitive data from previous memory store operations that should remain protected, resulting in the disclosure of privileged information. Exploitation requires local access with a low-privilege account and a high degree of attack complexity, and the leaked information crosses a privilege boundary (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N). Red Hat is pursuing fixes for the affected Red Hat Enterprise Linux 9 and 10 releases, and older Red Hat Enterprise Linux 8 minor streams are marked affected but outside active support scope. The Red Hat In-Vehicle OS 1.1 kernel and kernel-rt components were determined not to be affected. The Red Hat severity rating of Moderate is consistent with the upstream assessment.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. This issue is addressed by updated AMD microcode delivered through the linux-firmware package; updating to the latest available linux-firmware package for the affected Red Hat Enterprise Linux release applies the vendor fix.