VulnerabilityModified
CVE-2023-20561
Insufficient validation of the IOCTL (Input Output Control) input buffer in AMD μProf may allow an authenticated user to send an arbitrary address potentially resulting in a Windows crash leading to denial of service.
MEDIUM 5.5EPSS 0.27%
Does this matter?
Lower severity and a low EPSS score (0.27%). Track it; it rarely justifies an emergency change on its own.
Description
Insufficient validation of the IOCTL (Input Output Control) input buffer in AMD μProf may allow an authenticated user to send an arbitrary address potentially resulting in a Windows crash leading to denial of service.
- CVSS 3.1
- 5.5 MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 0.27% probability · 19th percentile
- CISA KEV
- Not listed
- Affected
- amd/amd uprof
- Source
- psirt@amd.com
References
- https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-7003Patch, Vendor Advisory
- https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-7003Patch, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.