Medium

TSA-L1 Transient Scheduler Attack on AMD Processors

IdentifiersCVE-2024-36357CWE-99

CVE-2024-36357, also known as Transient Scheduler Attack, L1 (TSA-L1), is a transient-execution side-channel vulnerability affecting some AMD processors, including AMD Zen 3 and Zen 4 systems. During specific microarchitectural timing windows, the CPU transient scheduler can speculatively retrieve stale data from the L1 data cache. A local attacker may use side-channel measurements to infer this data across privileged execution boundaries.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation causes confidentiality loss. A low-privileged local attacker may infer sensitive data resident in the L1D cache from a more privileged execution context, potentially crossing process, kernel, or virtualized workload privilege boundaries. The reported assessment specifies high confidentiality impact and no direct integrity or availability impact.

Mitigation

If you can’t patch tonight, do this now.

Apply the OS-specific TSA mitigation according to the operating-system vendor guidance and deploy OEM-provided BIOS/firmware updates for affected AMD platforms. Until updates are installed, reduce exposure to untrusted local users and untrusted guest workloads on affected systems; this is particularly relevant for multi-tenant and virtualization environments. No distinct software-only workaround is specified beyond applying the supplied operating-system and firmware mitigations.

Remediation

Patch, then assume compromise.

Apply the operating-system kernel updates supplied by the relevant distribution or platform vendor, and reboot to load the updated kernel and activate the mitigation. Deploy the applicable OEM BIOS update containing the AMD Platform Initialization firmware version for the affected platform. For Red Hat Enterprise Linux, install the fixed kernel updates for supported RHEL 9 or RHEL 10 releases and reboot. For SUSE systems, install the applicable updated kernel, Xen, and related packages and reboot.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

Citrix SystemsXenserverapplication

SuseLinux Enterprise Server 15 Sp6 Azure Kerneloperating_system

SuseLinux Kerneloperating_system

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

19 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

19 SOURCESView more in app

redhat accessNews

Jan 1, 2026

RHSA-2025:20518 - Security Advisory - Red Hat Customer Portal

AMD processor transient-execution vulnerability addressed through the kernel update.

redhat accessNews

Jan 1, 2026

RHSA-2025:20095 - Security Advisory - Red Hat Customer Portal

Transient-execution vulnerability affecting some AMD processors.

redhat accessNews

Jan 1, 2026

RHSA-2025:19930 - Security Advisory - Red Hat Customer Portal

A transient-execution vulnerability in the Linux kernel affecting some AMD processors, fixed through the Red Hat Enterprise Linux 9 kernel security update.

redhat otherNews

Nov 11, 2025

CVE-2024-36357 - Red Hat Customer Portal

A moderate-severity transient-execution vulnerability affecting some AMD processors that can expose sensitive L1D-cache data across privilege boundaries.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity5