« Volver al listado

CVE-2023-31348

Estado: ModificadaAlta (7.8)—

A DLL hijacking vulnerability in AMD μProf could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

AMD — Uprof

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-31348",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-31348",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-08-14T14:19:08.648854Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@amd.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.3,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.3
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@amd.com",
      "affectedData": [
        {
          "vendor": "AMD",
          "product": "μProf Tool",
          "versions": [
            {
              "status": "affected",
              "version": "μProf Tool",
              "lessThan": "3.4.494",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:amd:uprof_tool:*:*:*:*:*:*:*:*"
          ],
          "vendor": "amd",
          "product": "uprof_tool",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "3.4.494",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-08-13T17:15:21.307",
  "references": [
    {
      "url": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-9001",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@amd.com"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-427"
        }
      ]
    },
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A DLL hijacking vulnerability in AMD μProf could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de secuestro de DLL en AMD ?Prof podría permitir a un atacante lograr una escalada de privilegios, lo que potencialmente podría resultar en la ejecución de código arbitrario."
    }
  ],
  "lastModified": "2026-06-17T05:56:49.987",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:amd:uprof:*:*:*:*:*:linux:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4B13FA61-9E51-45AF-A0F8-0C3A518B390A",
              "versionEndExcluding": "4.1.424"
            },
            {
              "criteria": "cpe:2.3:a:amd:uprof:*:*:*:*:*:freebsd:*:*",
              "vulnerable": true,
              "matchCriteriaId": "50D6F227-1657-451F-AF90-A68B6A4BF03A",
              "versionEndExcluding": "4.2.816"
            },
            {
              "criteria": "cpe:2.3:a:amd:uprof:*:*:*:*:*:windows:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E175F21E-6872-42B1-8C4C-6B473440EE12",
              "versionEndExcluding": "4.2.845"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@amd.com"
}