CVE-2023-31307 - Vulnerability Details

Description

Improper validation of array index in Power Management Firmware (PMFW) may allow a privileged attacker to cause an out-of-bounds memory read within PMFW, potentially leading to a denial of service.

Published: 2024-08-13

Score: 2.3 Low

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

No analysis available yet.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

AMD

AMD Radeon™ RX 6000 Series Graphics Cards

affected

Version	Status	Constraints
`AMD Software: Adrenalin Edition 23.12.1 (23.30.13.01)`	unaffected	—

AMD

AMD Radeon™ PRO W6000 Series Graphics Cards

affected

Version	Status	Constraints
`AMD Software: PRO Edition 23.Q4 (23.30.13.03)`	unaffected	—

Configuration 1 [-]

AND

cpe:2.3:a:amd:radeon_software:*:*:*:*:adrenalin:*:*:*

OR	cpe:2.3:h:amd:radeon_rx_6300m:-:::::::*
	cpe:2.3:h:amd:radeon_rx_6400:-:::::::*
	cpe:2.3:h:amd:radeon_rx_6450m:-:::::::*
	cpe:2.3:h:amd:radeon_rx_6500_xt:-:::::::*
	cpe:2.3:h:amd:radeon_rx_6500m:-:::::::*
	cpe:2.3:h:amd:radeon_rx_6550m:-:::::::*
	cpe:2.3:h:amd:radeon_rx_6550s:-:::::::*
	cpe:2.3:h:amd:radeon_rx_6600:-:::::::*
	cpe:2.3:h:amd:radeon_rx_6600_xt:-:::::::*
	cpe:2.3:h:amd:radeon_rx_6600m:-:::::::*
	cpe:2.3:h:amd:radeon_rx_6600s:-:::::::*
	cpe:2.3:h:amd:radeon_rx_6650_xt:-:::::::*
	cpe:2.3:h:amd:radeon_rx_6650m:-:::::::*
	cpe:2.3:h:amd:radeon_rx_6650m_xt:-:::::::*
	cpe:2.3:h:amd:radeon_rx_6700:-:::::::*
	cpe:2.3:h:amd:radeon_rx_6700_xt:-:::::::*
	cpe:2.3:h:amd:radeon_rx_6700m:-:::::::*
	cpe:2.3:h:amd:radeon_rx_6700s:-:::::::*
	cpe:2.3:h:amd:radeon_rx_6750_gre:-:::::::*
	cpe:2.3:h:amd:radeon_rx_6750_xt:-:::::::*
	cpe:2.3:h:amd:radeon_rx_6800:-:::::::*
	cpe:2.3:h:amd:radeon_rx_6800_xt:-:::::::*
	cpe:2.3:h:amd:radeon_rx_6800m:-:::::::*
	cpe:2.3:h:amd:radeon_rx_6800s:-:::::::*
	cpe:2.3:h:amd:radeon_rx_6850m_xt:-:::::::*
	cpe:2.3:h:amd:radeon_rx_6900_xt:-:::::::*
	cpe:2.3:h:amd:radeon_rx_6950_xt:-:::::::*

Configuration 2 [-]

AND

cpe:2.3:a:amd:radeon_software:*:*:*:*:pro:*:*:*

OR	cpe:2.3:h:amd:radeon_pro_w6300:-:::::::*
	cpe:2.3:h:amd:radeon_pro_w6400:-:::::::*
	cpe:2.3:h:amd:radeon_pro_w6600:-:::::::*
	cpe:2.3:h:amd:radeon_pro_w6800:-:::::::*

No data.

No data available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
EUVD	EUVD-2023-35618	Improper validation of array index in Power Management Firmware (PMFW) may allow a privileged attacker to cause an out-of-bounds memory read within PMFW, potentially leading to a denial of service.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00061.

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://www.amd.com/en/resources/product-security/bulletin/amd-sb-6005.html

History

Fri, 13 Dec 2024 17:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Amd Amd radeon Pro W6300 Amd radeon Pro W6400 Amd radeon Pro W6600 Amd radeon Pro W6800 Amd radeon Rx 6300m Amd radeon Rx 6400 Amd radeon Rx 6450m Amd radeon Rx 6500 Xt Amd radeon Rx 6500m Amd radeon Rx 6550m Amd radeon Rx 6550s Amd radeon Rx 6600 Amd radeon Rx 6600 Xt Amd radeon Rx 6600m Amd radeon Rx 6600s Amd radeon Rx 6650 Xt Amd radeon Rx 6650m Amd radeon Rx 6650m Xt Amd radeon Rx 6700 Amd radeon Rx 6700 Xt Amd radeon Rx 6700m Amd radeon Rx 6700s Amd radeon Rx 6750 Gre Amd radeon Rx 6750 Xt Amd radeon Rx 6800 Amd radeon Rx 6800 Xt Amd radeon Rx 6800m Amd radeon Rx 6800s Amd radeon Rx 6850m Xt Amd radeon Rx 6900 Xt Amd radeon Rx 6950 Xt Amd radeon Software
CPEs		cpe:2.3:a:amd:radeon_software:::::adrenalin:::* cpe:2.3:a:amd:radeon_software:::::pro:::* cpe:2.3:h:amd:radeon_pro_w6300:-:::::::* cpe:2.3:h:amd:radeon_pro_w6400:-:::::::* cpe:2.3:h:amd:radeon_pro_w6600:-:::::::* cpe:2.3:h:amd:radeon_pro_w6800:-:::::::* cpe:2.3:h:amd:radeon_rx_6300m:-:::::::* cpe:2.3:h:amd:radeon_rx_6400:-:::::::* cpe:2.3:h:amd:radeon_rx_6450m:-:::::::* cpe:2.3:h:amd:radeon_rx_6500_xt:-:::::::* cpe:2.3:h:amd:radeon_rx_6500m:-:::::::* cpe:2.3:h:amd:radeon_rx_6550m:-:::::::* cpe:2.3:h:amd:radeon_rx_6550s:-:::::::* cpe:2.3:h:amd:radeon_rx_6600:-:::::::* cpe:2.3:h:amd:radeon_rx_6600_xt:-:::::::* cpe:2.3:h:amd:radeon_rx_6600m:-:::::::* cpe:2.3:h:amd:radeon_rx_6600s:-:::::::* cpe:2.3:h:amd:radeon_rx_6650_xt:-:::::::* cpe:2.3:h:amd:radeon_rx_6650m:-:::::::* cpe:2.3:h:amd:radeon_rx_6650m_xt:-:::::::* cpe:2.3:h:amd:radeon_rx_6700:-:::::::* cpe:2.3:h:amd:radeon_rx_6700_xt:-:::::::* cpe:2.3:h:amd:radeon_rx_6700m:-:::::::* cpe:2.3:h:amd:radeon_rx_6700s:-:::::::* cpe:2.3:h:amd:radeon_rx_6750_gre:-:::::::* cpe:2.3:h:amd:radeon_rx_6750_xt:-:::::::* cpe:2.3:h:amd:radeon_rx_6800:-:::::::* cpe:2.3:h:amd:radeon_rx_6800_xt:-:::::::* cpe:2.3:h:amd:radeon_rx_6800m:-:::::::* cpe:2.3:h:amd:radeon_rx_6800s:-:::::::* cpe:2.3:h:amd:radeon_rx_6850m_xt:-:::::::* cpe:2.3:h:amd:radeon_rx_6900_xt:-:::::::* cpe:2.3:h:amd:radeon_rx_6950_xt:-:::::::*
Vendors & Products		Amd Amd radeon Pro W6300 Amd radeon Pro W6400 Amd radeon Pro W6600 Amd radeon Pro W6800 Amd radeon Rx 6300m Amd radeon Rx 6400 Amd radeon Rx 6450m Amd radeon Rx 6500 Xt Amd radeon Rx 6500m Amd radeon Rx 6550m Amd radeon Rx 6550s Amd radeon Rx 6600 Amd radeon Rx 6600 Xt Amd radeon Rx 6600m Amd radeon Rx 6600s Amd radeon Rx 6650 Xt Amd radeon Rx 6650m Amd radeon Rx 6650m Xt Amd radeon Rx 6700 Amd radeon Rx 6700 Xt Amd radeon Rx 6700m Amd radeon Rx 6700s Amd radeon Rx 6750 Gre Amd radeon Rx 6750 Xt Amd radeon Rx 6800 Amd radeon Rx 6800 Xt Amd radeon Rx 6800m Amd radeon Rx 6800s Amd radeon Rx 6850m Xt Amd radeon Rx 6900 Xt Amd radeon Rx 6950 Xt Amd radeon Software

Tue, 03 Dec 2024 17:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-129

Tue, 13 Aug 2024 18:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 13 Aug 2024 17:00:00 +0000

Type	Values Removed	Values Added
Description		Improper validation of array index in Power Management Firmware (PMFW) may allow a privileged attacker to cause an out-of-bounds memory read within PMFW, potentially leading to a denial of service.
References		https://www.amd.com/en/resources/product-security/bulletin/amd-sb-6005.html
Metrics		cvssV3_1 `{'score': 2.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L'}`

Subscriptions

Amd Radeon Pro W6300 Radeon Pro W6400 Radeon Pro W6600 Radeon Pro W6800 Radeon Rx 6300m Radeon Rx 6400 Radeon Rx 6450m Radeon Rx 6500 Xt Radeon Rx 6500m Radeon Rx 6550m Radeon Rx 6550s Radeon Rx 6600 Radeon Rx 6600 Xt Radeon Rx 6600m Radeon Rx 6600s Radeon Rx 6650 Xt Radeon Rx 6650m Radeon Rx 6650m Xt Radeon Rx 6700 Radeon Rx 6700 Xt Radeon Rx 6700m Radeon Rx 6700s Radeon Rx 6750 Gre Radeon Rx 6750 Xt Radeon Rx 6800 Radeon Rx 6800 Xt Radeon Rx 6800m Radeon Rx 6800s Radeon Rx 6850m Xt Radeon Rx 6900 Xt Radeon Rx 6950 Xt Radeon Software

MITRE

Status: PUBLISHED

Assigner: AMD

Published: 2024-08-13T16:54:03.514Z

Updated: 2024-12-03T16:30:08.173Z

Reserved: 2023-04-27T15:25:41.422Z

Link: CVE-2023-31307

Vulnrichment

Updated: 2024-08-13T18:03:27.707Z

NVD

Status : Analyzed

Published: 2024-08-13T17:15:20.500

Modified: 2024-12-13T16:30:30.840

Link: CVE-2023-31307

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-129

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object