{"id":86934,"date":"2026-04-12T21:31:05","date_gmt":"2026-04-12T21:31:05","guid":{"rendered":""},"modified":"-0001-11-30T00:00:00","modified_gmt":"-0001-11-30T06:00:00","slug":"cve-2024-36354-critical-vulnerability-affecting-dimm-spd-metadata-input-validation","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2024-36354-critical-vulnerability-affecting-dimm-spd-metadata-input-validation\/","title":{"rendered":"CVE-2024-36354: Critical Vulnerability Affecting DIMM SPD Metadata Input Validation<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

This report details an identified vulnerability, CVE-2024-36354, in the improper input validation for Dual Inline Memory Module (DIMM) Serial Presence Detect (SPD) metadata. This flaw potentially impacts any system with a non-compliant DIMM, and it presents a significant threat due to the possibility of bypassing System Management Mode (SMM) isolation. The vulnerability could lead to arbitrary code execution at the SMM level and is therefore of high concern.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2024-36354
\nSeverity: High (CVSS: 7.5)
\nAttack Vector: Physical, Local, or Root of Trust for BIOS update
\nPrivileges Required: Ring0, Physical access, or Control over Root of Trust for BIOS update
\nUser Interaction: None
\nImpact: Bypassing SMM isolation potentially leading to arbitrary code execution at the SMM level. This could result in system compromise or data leakage.<\/p>\n

Affected Products<\/strong><\/p>

\r\n

\r\n \r\n \"Ameeba\r\n <\/a>\r\n A new way to communicate\r\n <\/h2>\r\n\r\n

\r\n Ameeba Chat is built on encrypted identity, not personal profiles.\r\n <\/p>\r\n\r\n

\r\n Message, call, share files, and coordinate with identities kept separate.\r\n <\/p>\r\n\r\n