CVE-2024-21954
Awaiting Analysis Awaiting Analysis - Queue

Improper Exception Handling in IOMMU Leads to DoS

Publication date: 2026-11-12

Last updated on: 2026-11-12

Assigner: Advanced Micro Devices Inc.

Description
Improper exception handling in IOMMU could allow an invalidate command to be sent to PCIe devices that do not support Address Translation Cache (ATC), potentially resulting in denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-12
Last Modified
2026-11-12
Generated
2026-11-12
AI Q&A
2026-11-12
EPSS Evaluated
N/A
NVD
CVE-2024-21954
EUVD
EUVD-2024-55846

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
amd iommu *
amd epyc_7003_series *
amd epyc_9004_series *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-754 The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves improper exception handling in IOMMU, where an invalidate command could be sent to PCIe devices that do not support Address Translation Cache (ATC). This may lead to a denial of service condition.

Detection Guidance

Detection involves checking for IOMMU-related errors or hangs in system logs, particularly when PCIe devices without ATC support are used. Monitor for excessive IOMMU timeouts or completion response delays. No specific commands are provided in the resources, but reviewing system logs for IOMMU-related errors and ensuring firmware is updated to mitigate the issue is recommended.

Impact Analysis

The vulnerability could cause a denial of service, potentially disrupting the normal operation of systems using affected AMD IOMMU devices.

Compliance Impact

This vulnerability primarily impacts system availability by causing a denial-of-service condition. While not directly linked to data privacy or security controls in GDPR or HIPAA, prolonged downtime could indirectly affect compliance by disrupting access to critical systems handling personal or health data.

Mitigation Strategies

Update AMD IOMMU drivers and firmware to the latest versions provided by AMD to address improper exception handling.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2024-21954. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...