CVE-2023-20562

Insufficient validation in the IOCTL (Input Output Control) input buffer in AMD uProf may allow an authenticated user to load an unsigned driver potentially leading to arbitrary kernel execution.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-7003	Patch Vendor Advisory
https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-7003	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:a:amd:amd_uprof:*:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:a:amd:amd_uprof:*:*:*:*:*:*:*:*

cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*

History

21 Nov 2024, 07:41

Type	Values Removed	Values Added
References	~~() https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-7003 - Patch, Vendor Advisory~~	() https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-7003 - Patch, Vendor Advisory

Information

Published : 2023-08-08 18:15

Updated : 2024-11-21 07:41

NVD link : CVE-2023-20562

Mitre link : CVE-2023-20562

CVE.ORG link : CVE-2023-20562

JSON object : View

Products Affected

amd

amd_uprof

linux

linux_kernel

microsoft

windows

CWE

NVD-CWE-noinfo

{"id": "CVE-2023-20562", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2023-08-08T18:15:11.467", "references": [{"url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-7003", "tags": ["Patch", "Vendor Advisory"], "source": "psirt@amd.com"}, {"url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-7003", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "\n\n\nInsufficient validation in the IOCTL (Input Output Control) input buffer in AMD uProf may allow an authenticated user to load an unsigned driver potentially leading to arbitrary kernel execution.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n"}], "lastModified": "2024-11-21T07:41:07.423", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:amd:amd_uprof:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AB1EF217-6C1D-4FED-8F8E-4AD79D74A536", "versionEndExcluding": "4.1.396"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:amd:amd_uprof:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BFC64885-C3DE-4FFB-8AD4-4B96722EC6D4", "versionEndExcluding": "4.1-424"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@amd.com"}

7.8 /10