CVE-2023-20560

2023-08-1522:15:09

CWE-20

[email protected]

web.nvd.nist.gov

cve-2023-20560

amd ryzen™ master

insufficient validation

input output control

privileged attacker

null value

windows crash

denial of service

4.4 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

4.9 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

Insufficient validation of the IOCTL (Input Output Control) input buffer in AMD Ryzen™ Master may allow a privileged attacker to provide a null value potentially resulting in a Windows crash leading to denial of service.

Affected configurations

NVD

Node

amdryzen_masterRange<2.11.2.2659

amdryzen_master_monitoring_sdkRange<august_2023

AND

microsoftwindows_10Match-

microsoftwindows_11Match-

CPENameOperatorVersion
amd:ryzen_masteramd ryzen masterlt2.11.2.2659
amd:ryzen_master_monitoring_sdkamd ryzen master monitoring sdkltaugust_2023

CPE	Name	Operator	Version
amd:ryzen_master	amd ryzen master	lt	2.11.2.2659
amd:ryzen_master_monitoring_sdk	amd ryzen master monitoring sdk	lt	august_2023

CNA Affected

[
  {
    "defaultStatus": "affected",
    "platforms": [
      "x86",
      "Windows"
    ],
    "product": "Ryzen™ Master",
    "vendor": "AMD",
    "versions": [
      {
        "lessThan": "2.11.2.2659",
        "status": "affected",
        "version": " ",
        "versionType": "custom"
      }
    ]
  }
]