CVE-2024-36319: AMD VCN Firmware Debug Code Vulnerability

CVE-2024-36319 Overview

CVE-2024-36319 is a firmware vulnerability in AMD's Video Decoder Engine Firmware (VCN FW). Debug code was left active in production firmware, allowing a local attacker with low privileges to submit a maliciously crafted command. The crafted command causes the VCN FW to perform arbitrary read and write operations against hardware registers. Successful exploitation can impact the confidentiality, integrity, and availability of the system. The weakness is tracked as [CWE-1191: On-Chip Debug and Test Interface With Improper Access Control].

Critical Impact
A local attacker can issue crafted commands to VCN FW to read/write hardware registers, escalating impact beyond the firmware boundary to affect overall system confidentiality, integrity, and availability.

Affected Products

AMD Video Decoder Engine Firmware (VCN FW)
AMD products shipping the affected VCN firmware (refer to AMD security bulletin for the full product matrix)
Systems using AMD GPU/APU components that load the affected VCN firmware image

Discovery Timeline

2026-02-12 - CVE-2024-36319 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2024-36319

Vulnerability Analysis

The Video Decoder Engine Firmware (VCN FW) ships with debug functionality that remained enabled in release builds. This debug code exposes command handlers that perform raw memory-mapped I/O against hardware registers. A local attacker with low privileges can submit a crafted command through the standard interface used to communicate with the VCN block. The firmware then services the command and performs attacker-controlled register reads or writes.

Because the VCN engine sits inside the security boundary of the GPU/APU, register-level access translates directly into manipulation of trusted hardware state. The classification under [CWE-1191] reflects the absence of access control on what should have been a development-only interface. The local attack vector and low privilege requirement mean exploitation does not require remote access or administrative rights on the host operating system.

Root Cause

Debug command handlers were not stripped or gated before the firmware was shipped to production. The handlers accept commands that translate into direct hardware register read/write operations without authorization checks. This violates the principle that debug and test interfaces must be disabled or strictly access-controlled in production builds.

Attack Vector

Exploitation requires local access and low privileges on a system running affected AMD hardware. The attacker submits a maliciously crafted command to the VCN firmware through the legitimate command submission channel. The firmware processes the command and performs the requested hardware register access on behalf of the attacker. No user interaction is required. Public proof-of-concept code is not available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified exploit code is available. Refer to the AMD Security Bulletin #6024 for technical details published by the vendor.

Detection Methods for CVE-2024-36319

Indicators of Compromise

No public indicators of compromise have been published for CVE-2024-36319.
Unexpected GPU/APU resets, hangs, or display subsystem instability on affected hardware may warrant further investigation.
Anomalous low-privileged processes interacting with GPU driver IOCTL interfaces or VCN command submission paths.

Detection Strategies

Inventory endpoints with affected AMD components and verify VCN firmware version against the fixed version listed in AMD's bulletin.
Monitor process behavior for unprivileged user-mode processes issuing unusual or high-frequency commands to GPU driver interfaces.
Correlate kernel-mode driver events with subsequent GPU/APU faults to identify potential abuse of the VCN command path.

Monitoring Recommendations

Enable endpoint telemetry for GPU driver load events, firmware version reporting, and hardware fault logs.
Track WHEA (Windows Hardware Error Architecture) and equivalent Linux MCE events for hardware register access anomalies.
Alert on userland processes opening handles to GPU control devices outside expected media or rendering workloads.

How to Mitigate CVE-2024-36319

Immediate Actions Required

Apply the firmware and driver updates referenced in AMD Security Bulletin #6024 as soon as the vendor package is available for your platform.
Identify all systems running affected AMD VCN firmware and prioritize patching of multi-user, shared, or untrusted-workload hosts.
Restrict local access to systems with vulnerable firmware until updates can be deployed.

Patch Information

AMD has published guidance and fixed firmware versions in AMD Security Bulletin #6024. Patched VCN firmware removes or disables the debug command handlers that enabled arbitrary hardware register access. Apply the firmware update through the OEM BIOS/UEFI update, GPU driver package, or platform vendor channel applicable to the affected device.

Workarounds

No vendor-supplied workaround is documented; firmware update is the supported remediation.
Limit local logon and process execution rights on affected systems to reduce the population of users who can submit crafted VCN commands.
Where hardware video decode is not required, evaluate disabling the affected functionality through driver configuration until patching is complete.

bash

# Verify AMD GPU driver/firmware version on Linux
lspci -nnk | grep -A3 -i 'VGA\|3D\|Display'
dmesg | grep -i -E 'amdgpu|vcn'
cat /sys/kernel/debug/dri/0/amdgpu_firmware_info 2>/dev/null