CVE-2024-36357: Xen Security Advisory 471 v1 (CVE-2024-36350,CVE-2024-36357) - x86: Transitive Scheduler Attacks
A transient execution vulnerability in some AMD processors may allow an attacker to infer data in the L1D cache, potentially resulting in the leakage of sensitive information across privileged boundaries.
Other sources
AMD: CVE-2024-36357 Transient Scheduler Attack in L1 Data Queue
— Microsoft
The vulnerability assigned to this CVE is in certain processor models offered by AMD. The mitigation for this vulnerability requires a Windows update. This CVE is being documented in the Security Update Guide to announce that the latest builds of Windows enable the mitigation and provide protection against the vulnerability. Please see the following for more information:
AMD-SB-7029
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/amd64-microcodeto a version that resolves this vulnerability.Fixed in 3.20251202.1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.257-1Fixed in 6.1.170-3Fixed in 6.1.174-1Fixed in 6.12.86-1Fixed in 6.12.94-1Fixed in 7.0.13-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.174-1~deb11u1 - Upgrade
Upgrade
debian/xento a version that resolves this vulnerability.Fixed in 4.17.5+72-g01140da4e8-1Fixed in 4.20.2+37-g61ff35323e-0+deb13u1Fixed in 4.20.2+7-g1badcf5035-0+deb13u1Fixed in 4.20.2+37-g61ff35323e-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch AMD-SB-7029 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch Xen Security Advisory 471 v1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch Xen Security Advisory 471 v2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch Xen Security Advisory 471 v3
Event History
Frequently Asked Questions
What is the severity of CVE-2024-36357?
CVE-2024-36357 is categorized as a high-severity vulnerability due to the potential leakage of sensitive information.
How do I fix CVE-2024-36357?
To mitigate CVE-2024-36357, it is recommended to apply firmware updates provided by the manufacturer for affected AMD processors.
What type of vulnerability is CVE-2024-36357?
CVE-2024-36357 is a transient execution vulnerability that may allow attackers to infer data from the L1D cache.
Which processors are affected by CVE-2024-36357?
CVE-2024-36357 affects certain AMD processors that are susceptible to transient execution attacks.
What could be the consequence of exploiting CVE-2024-36357?
Exploiting CVE-2024-36357 could allow an attacker to leak sensitive information across privileged boundaries, posing a significant security risk.