Skip to content
Fencer Intel
high 7.0

CVE-2024-21954 json

Improper exception handling in IOMMU could allow an invalidate command to be sent to PCIe devices that do not support Address Translation C…

published 2d ago modified 2d ago also EUVD-2024-55846

cvss
7.0
version 4.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 18%
public exploits
0
none known

Summary

Improper exception handling in IOMMU could allow an invalidate command to be sent to PCIe devices that do not support Address Translation Cache (ATC), potentially resulting in denial of service.

Patch / fix

  • AMD AMD EPYC™ 7003 Series Processors MilanPI-SP3_1.0.0.J
  • AMD AMD EPYC™ 9004 Series Processors GenoaPI_1.0.0.H
  • AMD AMD EPYC™ Embedded 7003 Series Processors EmbMilanPI-SP3 1.0.0.D
  • AMD AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed "Genoa") EmbGenoaPI-SP5 1.0.0.D

Is CVE-2024-21954 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2d ago

Exploit prediction

0.27% chance of exploitation in the next 30 days, higher than 18% of all scored CVEs (FIRST EPSS, 2026-11-14).

CVSS scores

assigned by version score vector
CNA 4.0 7.0 CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
CNA 4.0 7.0 CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

  • AMD AMD EPYC™ 7003 Series Processors
  • AMD AMD EPYC™ 9004 Series Processors
  • AMD AMD EPYC™ Embedded 7003 Series Processors
  • AMD AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed "Genoa")

Classification

Weakness
  • CWE-754 Improper Check for Unusual or Exceptional Conditions

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.