Introduction
Attackers can bypass firmware protections on AMD-powered systems while the machine resumes from standby, and may then be able to modify UEFI or other sensitive firmware components. The flaw is in AMD ROM Armor, a hardware-based security technology used in many consumer and enterprise devices, and it could allow a persistent compromise at the firmware level.
About AMD and ROM Armor: AMD is a major x86 processor vendor, selling into consumer, enterprise, and data center markets worldwide. ROM Armor ships in multiple AMD product lines. It is designed to block unauthorized modifications to SPI flash memory, which holds UEFI firmware and security-critical configuration data. Much of the security of an AMD-based platform rests on this mechanism.
Technical Information
CVE-2024-36326 is a missing authorization vulnerability in AMD ROM Armor that is triggered when the system resumes from standby. ROM Armor runs before the operating system initializes and restricts writes to SPI flash memory, so that only System Management Mode (SMM) handlers controlled by the OEM or ODM can modify firmware regions. The goal is to protect the integrity of UEFI and other firmware components.
When the system resumes from a low-power standby state, ROM Armor does not enforce its usual authorization checks. That leaves a timing window in which an attacker with local access can bypass ROM Armor and write to protected firmware regions. The flaw is classified under CWE-862 (Missing Authorization). Exploitation requires precise timing and local access to the system during the resume phase. No public code snippets or proof of concept are available.
Affected Systems and Versions
- AMD platforms that implement ROM Armor are affected, including systems with recent AMD processors in both consumer and enterprise segments.
- The vulnerability is present when the system resumes from standby (low-power) states.
- The available advisories do not list specific affected product families or firmware versions. Check your OEM or system vendor's advisory for model-specific information.
Vendor Security History
AMD has disclosed earlier vulnerabilities in its trusted computing and firmware protection mechanisms, including issues with SPI protection and SMM handler controls. The company publishes coordinated security bulletins (such as AMD-SB-4012) and works with OEMs on remediation. Distributing firmware updates can be complicated, because each vendor needs its own build and its own testing.
