Lucene search

Amd.comAMD-SB-1016

HistoryNov 09, 2021 - 12:00 a.m.

Potential Improper Access Control Vulnerability in AMD μProf Tool

2021-11-0900:00:00

amd.com

www.amd.com

9 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

9.9 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

43.3%

JSON

Bulletin ID: AMD-SB-1016 **Potential Impact:**Improper access / Code execution **Severity:**High

Summary

Potential improper access control vulnerability in AMD μProf Tool.

CVE Details

CVE-2021-26334

>p>The AMDPowerProfiler.sys driver of AMD μProf tool may allow lower privileged users to access MSRs in kernel which may lead to privilege escalation and ring-0 code execution by the lower privileged user.

Affected Products

AMD μProf

Mitigation

AMD recommends updating μProf to the following versions:

OS	Version
Windows binary	AMDuProf-3.4.494.exe
Linux – RPM package	amduprof-3.4-502.x86_64.rpm
Linux – DEB package	amduprof_3.4-502_amd64.deb
Linux – tar file	AMDuProf_Linux_x64_3.4.502.tar.bz2

9 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

9.9 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

43.3%

JSON

Related for AMD-SB-1016