CVE-2024-21924 impacts AMD EPYC and Ryzen Threadripper Processors

CVE-2024-21924 is a high-severity vulnerability discovered in AMD EPYC and Ryzen Threadripper processors. This vulnerability, identified by researchers at Eclypsium, poses significant risks, particularly due to its potential for exploitation within the System Management Mode (SMM).

Nature of the Vulnerability

CVE-2024-21924 is a vulnerability in the AmdPlatformRasSspSmm driver that allows a ring 0 attacker to modify boot service tables. This can lead to arbitrary code execution within SMM, a highly privileged mode of operation in x86 architecture that handles system-wide functions such as power management and hardware control. Exploitation of this vulnerability can compromise the security and integrity of the affected system.

Technical Details

Exploitation Method

Exploiting CVE-2024-21924 involves the following steps:

1. Compromising a System Component: The attacker must first gain ring 0 (kernel-level) access, which can be achieved through various methods such as exploiting another vulnerability or using malware with elevated privileges.
2. Modifying Boot Service Tables: Once ring 0 access is obtained, the attacker can modify the boot service tables in a way that affects the AmdPlatformRasSspSmm driver.
3. Executing Arbitrary Code in SMM: By manipulating the driver, the attacker can execute arbitrary code within SMM. This can have severe consequences, as SMM operates at a higher privilege level than the operating system kernel and can bypass most security controls.

Example of Exploitation

An example scenario might involve an attacker gaining access to a server running on an affected AMD EPYC processor. The attacker could exploit a software vulnerability to gain ring 0 access, then modify the boot service tables to hijack the AmdPlatformRasSspSmm driver, ultimately executing arbitrary code in SMM.

Impact

Potential Risks

The exploitation of this vulnerability can lead to several severe consequences, including:

• Compromise of System Integrity: Attackers can execute arbitrary code at the highest privilege level, potentially bypassing security mechanisms and gaining full control over the system.
• Data Exfiltration: Sensitive data stored in memory or on disk can be accessed and exfiltrated by the attacker.
• Persistence: Exploiting the SMM vulnerability allows attackers to establish persistent control over the system, making it challenging to detect and remove the malicious code.
• Disruption of Services: Critical system functions handled by SMM can be disrupted, potentially leading to system instability or denial of service.

CVSS Score and Metrics

The Common Vulnerability Scoring System (CVSS) provides a standardized way to rate the severity of vulnerabilities. For CVE-2024-21924, the CVSS scores are as follows:

• Base Score: 8.2 (High)
• Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
• Attack Vector (AV): Local – The attacker requires local access to the vulnerable system.
• Attack Complexity (AC): Low – The attack does not require complex conditions to be met.
• Privileges Required (PR): High – The attacker needs high-level privileges (ring 0 access).
• User Interaction (UI): None – Exploitation does not require user interaction.
• Scope (S): Changed – Exploitation affects resources beyond the vulnerable component.
• Confidentiality (C): High – Exploitation results in significant loss of confidentiality.
• Integrity (I): High – Exploitation results in significant impact on integrity.
• Availability (A): High – Exploitation results in significant impact on availability.

Mitigation Measures

To protect against the exploitation of CVE-2024-21924, organizations should implement the following mitigation measures:

1. Apply Security Patches

• Update Firmware: Ensure that all systems running affected AMD EPYC and Ryzen Threadripper processors are updated with the latest firmware patches provided by AMD. These updates address the vulnerability and mitigate the risk of exploitation.
• BIOS Updates: Apply BIOS updates provided by OEM vendors that include the necessary security fixes for the AmdPlatformRasSspSmm driver.

2. Enhance System Security

• Access Control: Limit access to systems running affected processors to trusted users only. Implement strict access control policies to prevent unauthorized access.
• Monitoring and Logging: Implement continuous monitoring and logging of system activities to detect any unusual behavior or potential exploitation attempts. Use security information and event management (SIEM) systems to analyze logs and identify threats.

3. Educate Users

• Security Awareness Training: Provide regular security awareness training for users to help them recognize potential security threats and follow best practices for system security.
• Incident Response: Develop and maintain an incident response plan to quickly address and mitigate the impact of security incidents.

Final Thoughts

CVE-2024-21924 is a high-severity vulnerability that requires immediate attention and remediation. By applying the recommended firmware and BIOS updates, enhancing system security measures, and educating users, organizations can mitigate the risks associated with this vulnerability and protect their systems from potential exploitation.