CVE-2024-21980

HIGH

AMD EPYC 7003 Series Firmware < milanpi_1.0.0.d - Memory Corruption via SNP Firmware Write Operations

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2024-21980. PoCs published by Freax13.

AI-analyzed exploit summary This repository contains a functional exploit for CVE-2024-21980, a vulnerability in AMD SEV firmware that allows decrypting arbitrary memory of an SEV-SNP guest after decommissioning. The exploit leverages a missing enforcement check in the `SEV_MCMD_ID_ATTESTATION` command to corrupt memory and force a static UMC key seed.

Description

Improper restriction of write operations in SNP firmware could allow a malicious hypervisor to potentially overwrite a guest's memory or UMC seed resulting in loss of confidentiality and integrity.

Exploits (1)

nomisec WORKING POC 8 stars

by Freax13 · poc

https://github.com/Freax13/cve-2024-21980-poc

View Code ZIP pw:eip

This repository contains a functional exploit for CVE-2024-21980, a vulnerability in AMD SEV firmware that allows decrypting arbitrary memory of an SEV-SNP guest after decommissioning. The exploit leverages a missing enforcement check in the `SEV_MCMD_ID_ATTESTATION` command to corrupt memory and force a static UMC key seed.

Classification

Working Poc 100%

Attack Type

Info Leak

Complexity

Complex

Reliability

Reliable

Target: AMD SEV firmware version 1.55.16

Auth required

Prerequisites: SEV or SEV-ES guest running · Victim SEV-SNP guest · Custom kernel patches · RMP covered area adjusted to 64GiB

MITRE ATT&CK

T1003 - OS Credential Dumping T1552 - Unsecured Credentials

devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (1)

Core 1

Core References

Broken Link vendor-advisory

https://https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3011.html

Scores

CVSS v3 7.9

EPSS 0.0045

EPSS Percentile 35.7%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-119 CWE-787

Status published

Products (50)

amd/epyc_7203_firmware < milanpi_1.0.0.d

amd/epyc_7203p_firmware < milanpi_1.0.0.d

amd/epyc_72f3_firmware < milanpi_1.0.0.d

amd/epyc_7303_firmware < milanpi_1.0.0.d

amd/epyc_7303p_firmware < milanpi_1.0.0.d

amd/epyc_7313_firmware < milanpi_1.0.0.d

amd/epyc_7313p_firmware < milanpi_1.0.0.d

amd/epyc_7343_firmware < milanpi_1.0.0.d

amd/epyc_7373x_firmware < milanpi_1.0.0.d

amd/epyc_73f3_firmware < milanpi_1.0.0.d

... and 40 more

Published Aug 05, 2024

Tracked Since Feb 18, 2026