Login Request a demo
Medium severity · published Aug 8, 2023
CVE-2023-20556
Insufficient validation of the IOCTL (Input Output Control) input buffer in AMD μProf may allow an authenticated user to send an arbitrary buffer potentially resulting in a…
5.5
CVSS
0.3%
EPSS
No
On KEV
Description
Insufficient validation of the IOCTL (Input Output Control) input buffer in AMD μProf may allow an authenticated user to send an arbitrary buffer potentially resulting in a Windows crash leading to denial of service.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 19% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AU
Amd Uprof · Amd
before 4.1.396; before 4.1-424 · source: NVD
Affected product
AU
Amd Uprof
Amd
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-20556
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-20556
Mitigation
https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-7003
More from Amd Uprof
9.9
CVE-2021-26334
The AMDPowerProfiler.sys driver of AMD μProf tool may allow lower privileged users to access MSRs in kernel which may lead to privilege escalation and ring-0 code execution by the…
7.8
CVE-2023-31349
Incorrect default permissions in the AMD μProf installation directory could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution
7.8
CVE-2023-20562
Insufficient validation in the IOCTL (Input Output Control) input buffer in AMD uProf may allow an authenticated user to load an unsigned driver potentially leading to arbitrary…
7.5
CVE-2022-27674
Insufficient validation in the IOCTL input/output buffer in AMD μProf may allow an attacker to bypass bounds checks potentially leading to a Windows kernel crash resulting in…
7.5
CVE-2022-23831
Insufficient validation of the IOCTL input buffer in AMD μProf may allow an attacker to send an arbitrary buffer leading to a potential Windows kernel crash resulting in denial of…