Input validation error in AMD products - CVE-2023-31310

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU96632

Input validation error in AMD products - CVE-2023-31310

Published: August 30, 2024


Vulnerability identifier: #VU96632
CSH Severity: Low
CVSS v4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-31310
CWE-ID: CWE-20
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to insufficient input validation in Power Management Firmware (PMFW). A local user can send a malformed input for the "set temperature input selection" command and execute arbitrary code with elevated privileges.


Affected software

AMD Instinct MI100
AMD Radeon Instinct MI25
AMD Radeon PRO V520
AMD Radeon PRO V620
Radeon RX 6000 Series
Radeon PRO W6000 Series

How to mitigate CVE-2023-31310

Install updates from vendor's website.

Radeon RX 6000 Series - update to 23.12.1
Radeon PRO W6000 Series - update to 23.30.13.03

External References