Vulnerability Disclosure:
Supermicro is aware of the System Management Mode (SMM) callout vulnerability reported by Eclypsium in the AmdPlatformRasSspSmm UEFI module supported on multiple AMD processors. This issue affects AMD EPYC™ 2nd Gen Processors and H11 and H12 generations of products.
CVE:
- CVE-2024-21924
- Severity: High
Findings:
This is an SMM callout vulnerability within the AmdPlatformRasSspSmm UEFI module, which is supported on various AMD processors. The report noted that this vulnerability could allow attackers to execute arbitrary code within SMM.
Analysis by AMD is that a ring 0 attacker could modify boot service tables to point to malicious code, potentially resulting in arbitrary code execution within SMM. AMD plans to release mitigations to address this vulnerability.
SMM callout vulnerability within the AmdPlatformRasSspSmm driver could allow a ring 0 attacker to modify boot services handlers, potentially resulting in arbitrary code execution.
Affected products:
| AMD Motherboard Generation | BIOS Version with the fix |
|---|---|
| H11 – Rome | v 3.1 |
| H12 – Rome | v 3.1 |
Remediation:
- All affected Supermicro motherboard SKUs will require a BIOS update to mitigate this potential vulnerability.
- An updated BIOS firmware had been created to mitigate this potential vulnerability. Supermicro is currently testing and validating affected products. Please check Release Notes for the resolution.