CVE-2024-36357

ubuntu amd64-microcode: Exposure of Sensitive Information in Shared Microarchitectural Structures during Transient Execution

Affected

ubuntu/amd64-microcode 3.20251202.1ubuntu0.24.04.1..*
ubuntu/amd64-microcode 3.20251202.1ubuntu0.25.10.1..*

Description

A transient execution vulnerability in some AMD processors may allow an attacker to infer data in the L1D cache, potentially resulting in the leakage of sensitive information across privileged boundaries.

Source: BSI WID Portal BSI CSAF redhat_csaf Ubuntu Security Notices cvelistv5 Microsoft Security Update Guide

Affected operating systems

linux
ubuntu / amd64-microcodenoble
linux
ubuntu / amd64-microcodequesting

Metrics

XIEM Effective CVSS

5.6

Source: cna-v3

EPSS percentile

27.4 %

Elevated — this CVE ranks above at least 10% of all CVEs scored today.

KEV status

—

Show all metrics

Severity

medium

44.11

no public PoC known

5.6

0.4 %

Low — model estimates < 1% exploitation likelihood.

Published

2025-07-08 17:01 UTC

CWE

CWE-1421

Weakness classes (CWE)

CWE-1421Base
Exposure of Sensitive Information in Shared Microarchitectural Structures during Transient Execution
A processor event may allow transient operations to access architecturally restricted data (for example, in another address space) in a shared microarchitectural structure (for example, a CPU cache), potentially exposing the data over a covert channel.
cwe.mitre.org →

References & sources

Linked advisories

csoonline2026-09-24 08:25 UTC
58 hardware vulnerabilities: A guide to the threats