AMD processors & SUSE Xen: transient execution side-channel information leakage and Xen hypervisor DoS (CVE-2024-36350) #shorts

Summary

Welcome to our security podcast. Today we’re discussing CVE-2024-36350, a transient execution vulnerability disclosed by AMD in mid-2025. This flaw could allow an attacker to infer data from previous stores on a range of EPYC and Ryzen processors, potentially leaking privileged information. We’ll also touch on the related SUSE Linux Xen security update that addresses a denial-of-service issue under the same CVE identifier.

Product details

AMD has confirmed the issue affects multiple product lines including: EPYC 7003, 8004, 9004 series; Ryzen 5000, 6000, 7000, 8000, 8040 series desktop, mobile and embedded processors; and Threadripper PRO 7000 WX. All require updated PI microcode (versions such as MilanPI 1.0.0.G, GenoaPI 1.0.0.E, ComboAM5PI 1.2.0.3, StormPeakPI-SP6 1.1.0.0i, etc.) plus the latest OS patches. Separately, SUSE Linux Enterprise has released Xen Important Security Update 2025:02325-1, which addresses a denial-of-service vulnerability tracked as CVE-2024-36350 in the Xen hypervisor package.

Vulnerability type summary

CVE-2024-36350 is classified under CWE-1421: Exposure of Sensitive Information in Shared Microarchitectural Structures during Transient Execution. In essence, it’s a Spectre-style issue where speculative execution over shared CPU resources can leak data across protection boundaries.

Details of the vulnerability

Under certain workloads, an attacker running unprivileged code can trigger speculative instructions that infer the contents of recently stored data before architectural checks complete. By carefully measuring timing or cache side-channels, they can reconstruct bits of privileged memory. AMD’s microcode fixes adjust the CPU’s speculation behavior and flush internal buffers at the right times to block this inference channel. Meanwhile, SUSE’s Xen patch prevents a crash scenario in the hypervisor when handling malformed guest memory operations, closing a separate DoS vector under the same CVE tag.

Conclusion

To protect your systems, apply the latest AMD microcode updates for your processor family and install all relevant OS and BIOS patches. SUSE Linux users should update the Xen package to version 2025:02325-1 or later. While performance impacts vary by workload, these mitigations are critical to prevent data leakage and service interruptions. Stay current with vendor advisories and maintain a robust patch management program.

Watch the full video on YouTube: CVE-2024-36350

Remediation and exploitation details

This chain involves the following actors

  • Unprivileged Guest Code: Attacker
  • System Administrator: Defender

This following systems are involved

  • AMD EPYC 7003/8004/9004/9V64H Processors (Server central processing unit): Vulnerable hardware
  • AMD Ryzen 5000/6000/7000/8000/7035/8040 Series (Desktop, mobile and embedded central processing unit): Vulnerable hardware
  • AMD Threadripper PRO 7000 WX Series (High-end workstation central processing unit): Vulnerable hardware
  • Xen Hypervisor on SUSE Linux (Virtual machine manager): Vulnerable software

Attack entry point

  • User-space Code Execution: Attacker runs unprivileged code inside a virtual machine or user process on the target platform.
  • Hypercall Interface: Attacker invokes hypercalls from a guest virtual machine to the Xen hypervisor.

Remediation actions

System Administrator
Apply updated AMD processor microcode and accompanying operating system patches
Affected AMD platforms
System Administrator
Install SUSE Linux Xen security advisory updates
Xen Hypervisor on SUSE Linux

Exploitation actions

Transient execution side-channel using store-forwarding mistraining

Unprivileged Guest Code
Leak privileged data via transient execution
AMD central processing unit
Examples:
  • 1. Flush a cache line to prepare a clean timing channel.
  • 2. Execute a sequence of store instructions to mistrain the store-to-load dependency predictor.
  • 3. Issue a load from a privileged or protected memory address speculatively, bypassing normal access checks.
  • 4. Perform a timing measurement on the cache to detect which cache line was loaded speculatively.
  • 5. Correlate timing results with memory addresses to reconstruct bytes of privileged data.
  • 6. Repeat across address ranges to recover larger data structures.

Malformed hypercall triggering error path

Unprivileged Guest Code
Cause denial-of-service in the hypervisor
Xen Hypervisor
Examples:
  • 1. Craft a hypercall with out-of-range or unexpected arguments.
  • 2. Deliver the hypercall repeatedly from the guest virtual machine.
  • 3. Drive the hypervisor into a panic state or infinite error loop.
  • 4. Observe crash or hang of the host managing multiple virtual machines.

Related Content

NOTE: The following related content has not been vetted and may be unsafe.

CVE database technical details

CVE ID
CVE-2024-36350
Description
A transient execution vulnerability in some AMD processors may allow an attacker to infer data from previous stores, potentially resulting in the leakage of privileged information.
Provider
AMD
CWE / problem types
CWE-1421 Exposure of Sensitive Information in Shared Microarchitectural Structures during Transient Execution
Affected Software Versions
AMD:AMD EPYC™ 7003 Series Processors:[{'status': 'unaffected', 'version': 'MilanPI 1.0.0.G + OS Updates'}],AMD:AMD EPYC™ 9004 Series Processors:[{'status': 'unaffected', 'version': 'GenoaPI 1.0.0.E + OS Updates'}],AMD:AMD EPYC™ 8004 Series Processors:[{'status': 'unaffected', 'version': 'GenoaPI 1.0.0.E + OS Updates'}],AMD:AMD EPYC™ 9V64H Processor:[{'status': 'unaffected', 'version': 'MI300PI 1.0.0.7 + OS Updates'}],AMD:AMD Ryzen™ 5000 Series Desktop Processors:[{'status': 'unaffected', 'version': 'ComboAM4v2PI 1.2.0.E + OS Updates'}],AMD:AMD Ryzen™ 5000 Series Desktop Processor with Radeon™ Graphics:[{'status': 'unaffected', 'version': 'ComboAM4v2PI 1.2.0.E + OS Updates'}],AMD:AMD Ryzen™ 7000 Series Desktop Processors:[{'status': 'unaffected', 'version': 'ComboAM5PI 1.2.0.3 + OS Updates'}, {'status': 'unaffected', 'version': 'ComboAM5PI 1.0.0.a+ OS Updates'}, {'status': 'unaffected', 'version': 'ComboAM5PI 1.1.0.3c+ OS Updates'}],AMD:AMD Ryzen™ 8000 Series Processor with Radeon™ Graphics:[{'status': 'unaffected', 'version': 'ComboAM5PI 1.2.0.3 + OS Updates'}, {'status': 'unaffected', 'version': 'ComboAM5PI 1.1.0.3c+ OS Updates'}],AMD:AMD Ryzen™ Threadripper™ PRO 7000 WX-Series Processors:[{'status': 'unaffected', 'version': 'StormPeakPI-SP6 1.1.0.0i + OS Updates'}, {'status': 'unaffected', 'version': 'StormPeakPI-SP6 1.0.0.1k + OS Updates'}],AMD:AMD Ryzen™ 6000 Series Processor with Radeon™ Graphics:[{'status': 'unaffected', 'version': 'RembrandtPI-FP7 1.0.0.Bb + OS Updates'}],AMD:AMD Ryzen™ 7035 Series Processor with Radeon™ Graphics:[{'status': 'unaffected', 'version': 'RembrandtPI-FP7 1.0.0.Bb + OS Updates'}],AMD:AMD Ryzen™ 7000 Series Processors with Radeon™ Graphics:[{'status': 'unaffected', 'version': 'CezannePI-FP6 1.0.1.1b + OS Updates'}],AMD:AMD Ryzen™ 7040 Series Processors with Radeon™ Graphics:[{'status': 'unaffected', 'version': 'PhoenixPI-FP8-FP7 1.2.0.0 + OS Updates'}],AMD:AMD Ryzen™ 8040 Series Mobile Processors with Radeon™ Graphics:[{'status': 'unaffected', 'version': 'PhoenixPI-FP8-FP7 1.2.0.0 + OS Updates'}],AMD:AMD Ryzen™ 7000 Series Mobile Processors:[{'status': 'unaffected', 'version': 'DragonRangeFL1 1.0.0.3g + OS Updates'}],AMD:AMD EPYC™ Embedded 7003 Series Processors:[{'status': 'unaffected', 'version': 'EmbMilanPI-SP3 1.0.0.A + OS updates'}],AMD:AMD EPYC™ Embedded 8004 Series Processors:[{'status': 'unaffected', 'version': 'EmbGenoaPI-SP5 1.0.0.9 + OS updates'}],AMD:AMD EPYC™ Embedded 9004 Series Processors:[{'status': 'unaffected', 'version': 'EmbGenoaPI-SP5 1.0.0.9 + OS updates'}],AMD:AMD Ryzen™ Embedded 5000 Series Processors:[{'status': 'unaffected', 'version': 'EmbAM4PI 1.0.0.7 + OS Update'}],AMD:AMD Ryzen™ Embedded 7000 Series Processors:[{'status': 'unaffected', 'version': 'EmbeddedAM5PI 1.0.0.3 + OS updates'}],AMD:AMD Ryzen™ Embedded V3000 Series Processors:[{'status': 'unaffected', 'version': 'Embedded-PI_FP7r2 100C + OS updates'}],AMD:AMD EPYC™ Embedded 97X4:[{'status': 'unaffected', 'version': 'EmbGenoaPI-SP5 1.0.0.9 + OS updates'}],AMD:AMD Ryzen™ 5000 Series Processors with Radeon™ Graphics:[{'status': 'unaffected', 'version': 'CezannePI-FP6 1.0.1.1b + OS Updates'}]
Date Published
2025-07-08T16:56:39.834Z
Last Updated
2025-07-08T20:23:25.907Z