« Volver al listado

CVE-2023-20562

Estado: ModificadaAlta (7.8)—

Insufficient validation in the IOCTL (Input Output Control) input buffer in AMD uProf may allow an authenticated user to load an unsigned driver potentially leading to arbitrary kernel execution.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

AMD — AMD Uprof

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-20562",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-20562",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-10-10T18:41:00.791824Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@amd.com",
      "affectedData": [
        {
          "vendor": "AMD",
          "product": "μProf",
          "versions": [
            {
              "status": "affected",
              "version": "various",
              "lessThan": "4.1.396",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "x86",
            "Windows"
          ],
          "defaultStatus": "affected"
        },
        {
          "vendor": " AMD",
          "product": "μProf",
          "versions": [
            {
              "status": "affected",
              "version": "various ",
              "lessThan": "4.1-424",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "x86",
            "Linux"
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:amd:uprof_tool:*:*:*:*:*:*:*:*"
          ],
          "vendor": "amd",
          "product": "uprof_tool",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "4.1.396",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "0",
              "lessThan": "4.1-424",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2023-08-08T18:15:11.467",
  "references": [
    {
      "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-7003",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "psirt@amd.com"
    },
    {
      "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-7003",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "\n\n\nInsufficient validation in the IOCTL (Input Output Control) input buffer in AMD uProf may allow an authenticated user to load an unsigned driver potentially leading to arbitrary kernel execution.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n"
    }
  ],
  "lastModified": "2026-06-17T05:30:18.870",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:amd:amd_uprof:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AB1EF217-6C1D-4FED-8F8E-4AD79D74A536",
              "versionEndExcluding": "4.1.396"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:amd:amd_uprof:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BFC64885-C3DE-4FFB-8AD4-4B96722EC6D4",
              "versionEndExcluding": "4.1-424"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "psirt@amd.com"
}