CVE-2023-31307

Published Aug 13, 2024 CVSS 3.1 · 2.3 Low EPSS < 1% KEV · Not listed

Description

Improper validation of array index in Power Management Firmware (PMFW) may allow a privileged attacker to cause an out-of-bounds memory read within PMFW, potentially leading to a denial of service.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

AMD

AMD Radeon™ RX 6000 Series Graphics Cards

affected

Version	Status	Constraints
`AMD Software: Adrenalin Edition 23.12.1 (23.30.13.01)`	unaffected	—

AMD

AMD Radeon™ PRO W6000 Series Graphics Cards

affected

Version	Status	Constraints
`AMD Software: PRO Edition 23.Q4 (23.30.13.03)`	unaffected	—

Configuration 1 [-]

AND

cpe:2.3:a:amd:radeon_software:*:*:*:*:adrenalin:*:*:*

OR	cpe:2.3:h:amd:radeon_rx_6300m:-:::::::*
	cpe:2.3:h:amd:radeon_rx_6400:-:::::::*
	cpe:2.3:h:amd:radeon_rx_6450m:-:::::::*
	cpe:2.3:h:amd:radeon_rx_6500_xt:-:::::::*
	cpe:2.3:h:amd:radeon_rx_6500m:-:::::::*
	cpe:2.3:h:amd:radeon_rx_6550m:-:::::::*
	cpe:2.3:h:amd:radeon_rx_6550s:-:::::::*
	cpe:2.3:h:amd:radeon_rx_6600:-:::::::*
	cpe:2.3:h:amd:radeon_rx_6600_xt:-:::::::*
	cpe:2.3:h:amd:radeon_rx_6600m:-:::::::*
	cpe:2.3:h:amd:radeon_rx_6600s:-:::::::*
	cpe:2.3:h:amd:radeon_rx_6650_xt:-:::::::*
	cpe:2.3:h:amd:radeon_rx_6650m:-:::::::*
	cpe:2.3:h:amd:radeon_rx_6650m_xt:-:::::::*
	cpe:2.3:h:amd:radeon_rx_6700:-:::::::*
	cpe:2.3:h:amd:radeon_rx_6700_xt:-:::::::*
	cpe:2.3:h:amd:radeon_rx_6700m:-:::::::*
	cpe:2.3:h:amd:radeon_rx_6700s:-:::::::*
	cpe:2.3:h:amd:radeon_rx_6750_gre:-:::::::*
	cpe:2.3:h:amd:radeon_rx_6750_xt:-:::::::*
	cpe:2.3:h:amd:radeon_rx_6800:-:::::::*
	cpe:2.3:h:amd:radeon_rx_6800_xt:-:::::::*
	cpe:2.3:h:amd:radeon_rx_6800m:-:::::::*
	cpe:2.3:h:amd:radeon_rx_6800s:-:::::::*
	cpe:2.3:h:amd:radeon_rx_6850m_xt:-:::::::*
	cpe:2.3:h:amd:radeon_rx_6900_xt:-:::::::*
	cpe:2.3:h:amd:radeon_rx_6950_xt:-:::::::*

Configuration 2 [-]

AND

cpe:2.3:a:amd:radeon_software:*:*:*:*:pro:*:*:*

OR	cpe:2.3:h:amd:radeon_pro_w6300:-:::::::*
	cpe:2.3:h:amd:radeon_pro_w6400:-:::::::*
	cpe:2.3:h:amd:radeon_pro_w6600:-:::::::*
	cpe:2.3:h:amd:radeon_pro_w6800:-:::::::*

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2023-35618	Improper validation of array index in Power Management Firmware (PMFW) may allow a privileged attacker to cause an out-of-bounds memory read within PMFW, potentially leading to a denial of service.

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.153% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://www.amd.com/en/resources/product-security/bulletin/amd-sb-6005.html

History

Dec 13, 2024 5:00 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Amd Amd radeon Pro W6300 Amd radeon Pro W6400 Amd radeon Pro W6600 Amd radeon Pro W6800 Amd radeon Rx 6300m Amd radeon Rx 6400 Amd radeon Rx 6450m Amd radeon Rx 6500 Xt Amd radeon Rx 6500m Amd radeon Rx 6550m Amd radeon Rx 6550s Amd radeon Rx 6600 Amd radeon Rx 6600 Xt Amd radeon Rx 6600m Amd radeon Rx 6600s Amd radeon Rx 6650 Xt Amd radeon Rx 6650m Amd radeon Rx 6650m Xt Amd radeon Rx 6700 Amd radeon Rx 6700 Xt Amd radeon Rx 6700m Amd radeon Rx 6700s Amd radeon Rx 6750 Gre Amd radeon Rx 6750 Xt Amd radeon Rx 6800 Amd radeon Rx 6800 Xt Amd radeon Rx 6800m Amd radeon Rx 6800s Amd radeon Rx 6850m Xt Amd radeon Rx 6900 Xt Amd radeon Rx 6950 Xt Amd radeon Software
CPEs		cpe:2.3:a:amd:radeon_software:::::adrenalin:::* cpe:2.3:a:amd:radeon_software:::::pro:::* cpe:2.3:h:amd:radeon_pro_w6300:-:::::::* cpe:2.3:h:amd:radeon_pro_w6400:-:::::::* cpe:2.3:h:amd:radeon_pro_w6600:-:::::::* cpe:2.3:h:amd:radeon_pro_w6800:-:::::::* cpe:2.3:h:amd:radeon_rx_6300m:-:::::::* cpe:2.3:h:amd:radeon_rx_6400:-:::::::* cpe:2.3:h:amd:radeon_rx_6450m:-:::::::* cpe:2.3:h:amd:radeon_rx_6500_xt:-:::::::* cpe:2.3:h:amd:radeon_rx_6500m:-:::::::* cpe:2.3:h:amd:radeon_rx_6550m:-:::::::* cpe:2.3:h:amd:radeon_rx_6550s:-:::::::* cpe:2.3:h:amd:radeon_rx_6600:-:::::::* cpe:2.3:h:amd:radeon_rx_6600_xt:-:::::::* cpe:2.3:h:amd:radeon_rx_6600m:-:::::::* cpe:2.3:h:amd:radeon_rx_6600s:-:::::::* cpe:2.3:h:amd:radeon_rx_6650_xt:-:::::::* cpe:2.3:h:amd:radeon_rx_6650m:-:::::::* cpe:2.3:h:amd:radeon_rx_6650m_xt:-:::::::* cpe:2.3:h:amd:radeon_rx_6700:-:::::::* cpe:2.3:h:amd:radeon_rx_6700_xt:-:::::::* cpe:2.3:h:amd:radeon_rx_6700m:-:::::::* cpe:2.3:h:amd:radeon_rx_6700s:-:::::::* cpe:2.3:h:amd:radeon_rx_6750_gre:-:::::::* cpe:2.3:h:amd:radeon_rx_6750_xt:-:::::::* cpe:2.3:h:amd:radeon_rx_6800:-:::::::* cpe:2.3:h:amd:radeon_rx_6800_xt:-:::::::* cpe:2.3:h:amd:radeon_rx_6800m:-:::::::* cpe:2.3:h:amd:radeon_rx_6800s:-:::::::* cpe:2.3:h:amd:radeon_rx_6850m_xt:-:::::::* cpe:2.3:h:amd:radeon_rx_6900_xt:-:::::::* cpe:2.3:h:amd:radeon_rx_6950_xt:-:::::::*
Vendors & Products		Amd Amd radeon Pro W6300 Amd radeon Pro W6400 Amd radeon Pro W6600 Amd radeon Pro W6800 Amd radeon Rx 6300m Amd radeon Rx 6400 Amd radeon Rx 6450m Amd radeon Rx 6500 Xt Amd radeon Rx 6500m Amd radeon Rx 6550m Amd radeon Rx 6550s Amd radeon Rx 6600 Amd radeon Rx 6600 Xt Amd radeon Rx 6600m Amd radeon Rx 6600s Amd radeon Rx 6650 Xt Amd radeon Rx 6650m Amd radeon Rx 6650m Xt Amd radeon Rx 6700 Amd radeon Rx 6700 Xt Amd radeon Rx 6700m Amd radeon Rx 6700s Amd radeon Rx 6750 Gre Amd radeon Rx 6750 Xt Amd radeon Rx 6800 Amd radeon Rx 6800 Xt Amd radeon Rx 6800m Amd radeon Rx 6800s Amd radeon Rx 6850m Xt Amd radeon Rx 6900 Xt Amd radeon Rx 6950 Xt Amd radeon Software

Dec 3, 2024 5:15 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-129

Aug 13, 2024 6:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Aug 13, 2024 5:00 PM Description updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Improper validation of array index in Power Management Firmware (PMFW) may allow a privileged attacker to cause an out-of-bounds memory read within PMFW, potentially leading to a denial of service.
References		https://www.amd.com/en/resources/product-security/bulletin/amd-sb-6005.html
Metrics		cvssV3_1 `{'score': 2.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L'}`

Subscriptions

Amd Radeon Pro W6300 Radeon Pro W6400 Radeon Pro W6600 Radeon Pro W6800 Radeon Rx 6300m Radeon Rx 6400 Radeon Rx 6450m Radeon Rx 6500 Xt Radeon Rx 6500m Radeon Rx 6550m Radeon Rx 6550s Radeon Rx 6600 Radeon Rx 6600 Xt Radeon Rx 6600m Radeon Rx 6600s Radeon Rx 6650 Xt Radeon Rx 6650m Radeon Rx 6650m Xt Radeon Rx 6700 Radeon Rx 6700 Xt Radeon Rx 6700m Radeon Rx 6700s Radeon Rx 6750 Gre Radeon Rx 6750 Xt Radeon Rx 6800 Radeon Rx 6800 Xt Radeon Rx 6800m Radeon Rx 6800s Radeon Rx 6850m Xt Radeon Rx 6900 Xt Radeon Rx 6950 Xt Radeon Software

Weaknesses