CVE-2024-56721

What it actually does

Missing empty terminating entry in erratum_1386_microcode array allows x86_match_cpu_with_stepping() to continue iterating past array end, resulting in out-of-bounds memory access on AMD CPUs.

Why it matters to the business

Potential kernel instability, crashes, or information disclosure on affected Linux systems; listed in multiple 2024 exploitation campaigns by espionage and financially motivated actors, requiring prompt attention despite low EPSS.

How an attack unfolds

Attacker triggers x86 CPU matching functions on vulnerable AMD systems; the function walks the microcode array without termination, reading adjacent memory and enabling info leaks or crashes as seen in listed zero-day and Linux kernel OOB campaigns.

How to fix it

Apply the listed fixed versions for firefox on Ubuntu 14.04 LTS (50.0+build2-0ubuntu0.14.04.2) or equivalent kernel updates that include the terminating array entry; prioritize patching given threat actor activity.

How to confirm the fix worked

Verify the erratum_1386_microcode array ends with an empty entry in kernel source; confirm updated firefox or kernel packages are installed and test CPU matching behavior on AMD hardware.

Typical attack path

1. Identify AMD CPU via system calls or user-space interfaces
2. Invoke x86_match_cpu_with_stepping() path
3. Trigger unbounded array iteration due to missing terminator
4. Perform out-of-bounds read for information disclosure or denial of service

How to detect it

Inspect kernel logs and audit trails for repeated or anomalous calls to CPU stepping match functions; look for artifacts from listed 2024 zero-day and Linux kernel out-of-bounds campaigns by espionage actors.

What your security team should do

• Immediately update affected firefox packages to 50.0+build2-0ubuntu0.14.04.2 on Ubuntu 14.04 LTS systems
• Monitor for kernel updates addressing AMD errata on all Linux deployments
• Review logs for unusual CPU identification or matching activity from listed threat actors
• Scan for signs of exploitation in Linux kernel OOB-related campaigns