Vulnerability in AMD CPU
CVE-2024-2193
A Speculative Race Condition (SRC) vulnerability that impacts modern CPU architectures supporting speculative execution (related to Spectre V1) has been disclosed. An unauthenticated attacker can exploit this vulnerability to disclose arbitrary data from the CPU using race conditions to access the speculative executable code paths.
Vulnerability class: Race Condition
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.7 (Medium). Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N.
EPSS exploit prediction
EPSS: 0.013 (68.8th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 69th percentile — 68.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.013 · newest: 0.013 · change: +0.000
Affected products
Weakness classification (CWE)
Public proof-of-concept exploits
References
- kb.cert.org/vuls/id/488902
- xenbits.xen.org/xsa/advisory-453.html
- www.vusec.net/projects/ghostrace/
- download.vusec.net/papers/ghostrace_sec24.pdf
- git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/patch/
- ibm.github.io/system-security-research-updates/2024/03/12/ghostrace
- www.amd.com/en/resources/product-security/bulletin/amd-sb-7016.html
- www.kb.cert.org/vuls/id/488902
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/…
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/…
Frequently asked questions
- What is CVE-2024-2193?
- CVE-2024-2193 is a medium-severity vulnerability in AMD CPU, classified under Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition). CVSS score: 5.7/10. Published 2024-03-15.
- How severe is CVE-2024-2193?
- Medium severity. CVSS v3 base score is 5.7 out of 10.
- Is CVE-2024-2193 known to be exploited?
- 6 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.