CVE-2024-36340

A junction point vulnerability within AMD uProf can allow a local low-privileged attacker to create junction points, potentially resulting in arbitrary file deletion or disclosure...

kernel: drm/amd/display: Increase array size of dummy_boolean

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Increase array size of dummyboolean WHY dml2coresharedmodesupport and dmlcoremodesupport access the third element of dummyboolean, i.e. hwdebug5 = &s-dummyboolean2, when dummyboolean has size of 2. Any assignment...

kernel: cpufreq: amd-pstate: add check for cpufreq_cpu_get's return value

In the Linux kernel, the following vulnerability has been resolved: cpufreq: amd-pstate: add check for cpufreqcpuget's return value cpufreqcpuget may return NULL. To avoid NULL-dereference check it and return in case of error. Found by Linux Verification Center linuxtesting.org with SVACE...

AMD CPU Microcode Security Update

AMD has informed HP of a potential security vulnerability identified in the microcode patch loader for some AMD processors, which might allow arbitrary code execution and information disclosure. AMD is releasing firmware updates to mitigate these vulnerabilities. AMD has released updates to...

PT-2025-20899 · Amd · Amd Uprof

Name of the Vulnerable Software and Affected Versions: AMD uProf affected versions not specified Description: A junction point vulnerability within AMD uProf can allow a local low-privileged attacker to create junction points, potentially resulting in arbitrary file deletion or disclosure...

PT-2025-20931 · Amd · Aocl

Name of the Vulnerable Software and Affected Versions: AMD Optimizing CPU Libraries AOCL affected versions not specified Description: The issue is related to incorrect default permissions in the AOCL installation directory, which could allow an attacker to achieve privilege escalation, potentiall...

Spectre-v2 Domain Isolation

AMD ID: AMD-SB-7034 Potential Impact: N/A Severity: N/A Summary Researchers from VU Amsterdam have shared with AMD a paper exploring the effectiveness of domain isolation against Spectre-v2 type attacks. AMD believes the techniques described by the researchers are not applicable to AMD products...

ALSA-2025:7043 Moderate: microcode_ctl security update

The microcodectl packages provide microcode updates for Intel and AMD processors. Security Fixes: microcodectl: Improper input validation in UEFI firmware CVE-2024-28047 microcodectl: Insufficient granularity of access control in UEFI firmware CVE-2024-39279 microcodectl: mproper initialization i...

PT-2025-20929 · Amd · Amd Manageability Api

Name of the Vulnerable Software and Affected Versions: AMD Manageability API affected versions not specified Description: A DLL hijacking issue in the AMD Manageability API could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution. Recommendations:...

Privilege Desynchronization: Cross-Privilege Spectre Attacks with Branch Privilege Injection

AMD ID: AMD-SB-7030 Potential Impact: N/A Severity: N/A Summary Researchers from ETH Zurich have provided AMD with a paper titled “Privilege Desynchronization: Cross-Privilege Spectre Attacks with Branch Privilege Injection.” AMD reviewed the paper and believes that this vulnerability does not...

AMD Optimizing CPU Libraries (AOCL) Vulnerabilities

CVE Details Refer to Glossary for explanation of terms CVE| CVSS Score| CVE Description ---|---|--- CVE-2024-21960| 7.3highCVSS3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H| Incorrect default permissions in the AMD Optimizing CPU Libraries AOCL installation directory could allow an attacker to achieve...

Moderate: microcode_ctl security update

The microcodectl packages provide microcode updates for Intel and AMD processors. Security Fixes: microcodectl: Improper input validation in UEFI firmware CVE-2024-28047 microcodectl: Insufficient granularity of access control in UEFI firmware CVE-2024-39279 microcodectl: mproper initialization i...

PT-2025-20933 · Amd · Amd Optimizing Cpu Libraries

Name of the Vulnerable Software and Affected Versions: AMD Optimizing CPU Libraries affected versions not specified Description: A DLL hijacking issue in the AMD Optimizing CPU Libraries could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution...

PT-2025-20935 · Amd · Amd Cloud Manageability Service

Name of the Vulnerable Software and Affected Versions: AMD Cloud Manageability Service affected versions not specified Description: The issue is related to an unquoted search path within the AMD Cloud Manageability Service, which can be exploited by a local attacker to escalate privileges. This...

RHEL 9 : microcode_ctl (RHSA-2025:7043)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:7043 advisory. The microcodectl packages provide microcode updates for Intel and AMD processors. Security Fixes: microcodectl: Improper input validation in...

PT-2025-20930 · Amd · Amd Manageability Api

Name of the Vulnerable Software and Affected Versions: AMD Manageability API affected versions not specified Description: The issue is related to incorrect default permissions in the AMD Manageability API, which could allow an attacker to achieve privilege escalation, potentially resulting in...

AMD Manageability Tools Vulnerabilities

AMD ID: AMD-SB-9015 Potential Impact: Arbitrary Code execution Severity: High Summary Vulnerabilities were reported in various AMD Manageability Tools. AMD has provided mitigations for these issues. Please refer to Affected Products and Mitigations below...

AMD uProf Vulnerability

CVE Details Refer to Glossary for explanation of terms CVE| CVSS Severity| CVE Description ---|---|--- CVE-2024-36340| 6.6 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N| A junction point vulnerability within AMD uProf can allow a local low-privileged attacker to create junction points,...

SUSE CVE-2025-37855

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Guard Possible Null Pointer Dereference WHY In some situations, dc-respool may be null. HOW Check if pointer is null before dereference...

CVE-2025-37870

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: prevent hang on link training fail Why When link training fails, the phy clock will be disabled. However, in enablestreams, it is assumed that link training succeeded and the mux selects the phy clock, causing a...