PT-2025-11122 · Advanced Micro Devices Inc.+1 · Amd Instinct Mi300A

Published 2025-02-11 · Updated 2025-09-23 · CVE-2024-21927

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Satellite Management Controller (SMC) (affected versions not specified)

Description Insufficient input validation in the Satellite Management Controller (SMC) could allow an attacker with certain privileges to utilize specific special characters within Redfish® API commands. This manipulation may lead to crashes and resets of service processes, such as OpenBMC, potentially resulting in a denial of service. The vulnerability exists in the firmware of AMD MI300X processors. The attacker must be able to send manipulated commands to the API endpoints used by the SMC. The issue involves improper validation of input provided to the SMC, specifically within the Redfish® API.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

RCE

Weakness Enumeration

CWE-20

CWE-241

Related Identifiers

BDU:2025-02528

CVE-2024-21927

Affected Products

Amd Instinct Mi300A

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-21927 · Security Note
• https://bdu.fstec.ru/vul/2025-02528 · Security Note
• https://twitter.com/CVEnew/status/1970621781397643664 · Twitter Post
• https://t.me/CVEtracker/33207 · Telegram Post
• https://t.me/cveNotify/136215 · Telegram Post
• https://amd.com/en/resources/product-security/bulletin/AMD-SB-6016.html · Note
• https://amd.com/en/resources/product-security/bulletin/amd-sb-6016.html · Note