AMD Instinct accelerator management firmware: out-of-bounds read by a privileged local attacker

CVSS 1.8CVE-2024-21950Firmware, BMC & network fabriccurated

Impact

The remote management firmware on MI300X, MI300A, MI325X and MI308X accelerators reads outside its intended bounds, so an attacker who already holds privileged access to the management path can recover a limited slice of firmware memory or push the management interface into an unavailable state. On a shared GPU host this is a confidentiality and availability concern for the out-of-band control surface rather than a path to tenant workloads: AMD rates it 1.8, the lowest band, because it needs high privileges, local access and high attack complexity. Its practical value to an operator is as a reason to keep Instinct management firmware on the current level during an already-scheduled maintenance window, not to open one.

Who can reach it

Local, authenticated, and already privileged - an actor with high-privilege access to the accelerator's management interface on the host. No tenant or network-only path is described in the advisory.

What to do

Apply the firmware update referenced in AMD bulletin AMD-SB-6027 for the affected Instinct parts. Accelerator management firmware is flashed with the node out of production, so fold it into the next planned maintenance on each node; the severity does not justify an unscheduled drain.

References

https://nvd.nist.gov/vuln/detail/CVE-2024-21950 https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-6027.html

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.