CVE-2023-31349

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-31349", "assignerOrgId": "b58fc414-a1e4-4f92-9d70-1add41838648", "state": "PUBLISHED", "assignerShortName": "AMD", "dateReserved": "2023-04-27T15:25:41.427Z", "datePublished": "2024-08-13T16:57:28.998Z", "dateUpdated": "2024-08-13T18:02:44.526Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "\u03bcProf Tool", "vendor": "AMD", "versions": [{"lessThan": "3.4.494", "status": "affected", "version": "\u03bcProf Tool", "versionType": "custom"}]}], "datePublic": "2024-08-13T04:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">\n\n<span style=\"background-color: rgb(255, 255, 255);\">Incorrect default permissions in the AMD \u03bcProf installation directory could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution.</span>\n\n</span>\n\n\n\n\n\n<br>"}], "value": "Incorrect default permissions in the AMD \u03bcProf installation directory could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-276", "description": "CWE-276 Incorrect Default Permissions", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "b58fc414-a1e4-4f92-9d70-1add41838648", "shortName": "AMD", "dateUpdated": "2024-08-13T16:57:28.998Z"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-9001"}], "source": {"advisory": "AMD-SB-1016", "discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "psirt@amd.com", "DATE_PUBLIC": "2021-11-09T20:30:00.000Z", "ID": "CVE-2021-26334", "STATE": "PUBLIC", "TITLE": "AMD Chipset Driver Information Disclosure Vulnerability"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "\u03bcProf Tool", "version": {"version_data": [{"version_affected": "<", "version_name": "\u03bcProf Tool", "version_value": "3.4.494"}]}}]}, "vendor_name": "AMD"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The AMDPowerProfiler.sys driver of AMD \u03bcProf tool may allow lower privileged users to access MSRs in kernel which may lead to privilege escalation and ring-0 code execution by the lower privileged user."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-284 Improper Access Control"}]}]}, "references": {"reference_data": [{"name": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1016", "refsource": "MISC", "url": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1016"}]}, "source": {"advisory": "AMD-SB-1016", "discovery": "EXTERNAL"}}}, "adp": [{"affected": [{"vendor": "amd", "product": "amd_uprof", "cpes": ["cpe:2.3:a:amd:amd_uprof:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "3.4.494", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-08-13T18:00:48.359499Z", "id": "CVE-2023-31349", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-13T18:02:44.526Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-31349", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-08-13T18:00:48.359499Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:amd:amd_uprof:*:*:*:*:*:*:*:*"], "vendor": "amd", "product": "amd_uprof", "versions": [{"status": "affected", "version": "0", "lessThan": "3.4.494", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-13T18:02:27.443Z"}}], "cna": {"source": {"advisory": "AMD-SB-1016", "discovery": "EXTERNAL"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "AMD", "product": "\u03bcProf Tool", "versions": [{"status": "affected", "version": "\u03bcProf Tool", "lessThan": "3.4.494", "versionType": "custom"}], "defaultStatus": "unaffected"}], "datePublic": "2024-08-13T04:00:00.000Z", "references": [{"url": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-9001", "tags": ["x_refsource_MISC"]}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "descriptions": [{"lang": "en", "value": "Incorrect default permissions in the AMD \u03bcProf installation directory could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution.", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">\n\n<span style=\"background-color: rgb(255, 255, 255);\">Incorrect default permissions in the AMD \u03bcProf installation directory could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution.</span>\n\n</span>\n\n\n\n\n\n<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-276", "description": "CWE-276 Incorrect Default Permissions"}]}], "providerMetadata": {"orgId": "b58fc414-a1e4-4f92-9d70-1add41838648", "shortName": "AMD", "dateUpdated": "2024-08-13T16:57:28.998Z"}, "x_legacyV4Record": {"source": {"advisory": "AMD-SB-1016", "discovery": "EXTERNAL"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"version": {"version_data": [{"version_name": "\u03bcProf Tool", "version_value": "3.4.494", "version_affected": "<"}]}, "product_name": "\u03bcProf Tool"}]}, "vendor_name": "AMD"}]}}, "data_type": "CVE", "generator": {"engine": "Vulnogram 0.0.9"}, "references": {"reference_data": [{"url": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1016", "name": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1016", "refsource": "MISC"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "eng", "value": "The AMDPowerProfiler.sys driver of AMD \u03bcProf tool may allow lower privileged users to access MSRs in kernel which may lead to privilege escalation and ring-0 code execution by the lower privileged user."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-284 Improper Access Control"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2021-26334", "STATE": "PUBLIC", "TITLE": "AMD Chipset Driver Information Disclosure Vulnerability", "ASSIGNER": "psirt@amd.com", "DATE_PUBLIC": "2021-11-09T20:30:00.000Z"}}}}, "cveMetadata": {"cveId": "CVE-2023-31349", "state": "PUBLISHED", "dateUpdated": "2024-08-13T18:02:44.526Z", "dateReserved": "2023-04-27T15:25:41.427Z", "assignerOrgId": "b58fc414-a1e4-4f92-9d70-1add41838648", "datePublished": "2024-08-13T16:57:28.998Z", "assignerShortName": "AMD"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "\u03bcProf Tool", "vendor": "AMD", "versions": [{"lessThan": "3.4.494", "status": "affected", "version": "\u03bcProf Tool", "versionType": "custom"}]}], "source": "psirt@amd.com"}, {"affectedData": [{"cpes": ["cpe:2.3:a:amd:amd_uprof:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "amd_uprof", "vendor": "amd", "versions": [{"lessThan": "3.4.494", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:amd:uprof:*:*:*:*:*:linux:*:*", "matchCriteriaId": "4B13FA61-9E51-45AF-A0F8-0C3A518B390A", "versionEndExcluding": "4.1.424", "vulnerable": true}, {"criteria": "cpe:2.3:a:amd:uprof:*:*:*:*:*:freebsd:*:*", "matchCriteriaId": "50D6F227-1657-451F-AF90-A68B6A4BF03A", "versionEndExcluding": "4.2.816", "vulnerable": true}, {"criteria": "cpe:2.3:a:amd:uprof:*:*:*:*:*:windows:*:*", "matchCriteriaId": "E175F21E-6872-42B1-8C4C-6B473440EE12", "versionEndExcluding": "4.2.845", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Incorrect default permissions in the AMD \u03bcProf installation directory could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution."}, {"lang": "es", "value": "Los permisos predeterminados incorrectos en el directorio de instalaci\u00f3n de AMD ?Prof podr\u00edan permitir que un atacante logre una escalada de privilegios, lo que podr\u00eda resultar en la ejecuci\u00f3n de c\u00f3digo arbitrario."}], "id": "CVE-2023-31349", "lastModified": "2026-06-17T05:56:50.120", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 5.9, "source": "psirt@amd.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-31349", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2024-08-13T18:00:48.359499Z", "version": "2.0.3"}}]}, "published": "2024-08-13T17:15:21.500", "references": [{"source": "psirt@amd.com", "tags": ["Vendor Advisory"], "url": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-9001"}], "sourceIdentifier": "psirt@amd.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-276"}], "source": "psirt@amd.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-276"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}