CVE-2023-31307 : Improper validation of array index in Power Management Firmware (PMFW) may allow

Improper validation of array index in Power Management Firmware (PMFW) may allow a privileged attacker to cause an out-of-bounds memory read within PMFW, potentially leading to a denial of service.

Published 2024-08-13 16:54:04

Updated 2024-12-13 16:30:31

Source Advanced Micro Devices Inc.

View at NVD, CVE.org

Vulnerability category: Denial of service

Products affected by CVE-2023-31307

AMD » Radeon Software » PRO Edition
Versions up to, including, (<=) 23.q4
cpe:2.3:a:amd:radeon_software:*:*:*:*:pro:*:*:*
Matching versions
When used together with: AMD » Radeon Pro W6300 » Version: N/A
When used together with: AMD » Radeon Pro W6400 » Version: N/A
When used together with: AMD » Radeon Pro W6600 » Version: N/A
When used together with: AMD » Radeon Pro W6800 » Version: N/A
AMD » Radeon Software » Adrenalin Edition
Versions before (<) 23.12.1
cpe:2.3:a:amd:radeon_software:*:*:*:*:adrenalin:*:*:*
Matching versions
When used together with: AMD » Radeon Rx 6300m » Version: N/A
When used together with: AMD » Radeon Rx 6400 » Version: N/A
When used together with: AMD » Radeon Rx 6450m » Version: N/A
When used together with: AMD » Radeon Rx 6500 Xt » Version: N/A
When used together with: AMD » Radeon Rx 6500m » Version: N/A
When used together with: AMD » Radeon Rx 6550m » Version: N/A
When used together with: AMD » Radeon Rx 6550s » Version: N/A
When used together with: AMD » Radeon Rx 6600 » Version: N/A
When used together with: AMD » Radeon Rx 6600 Xt » Version: N/A
When used together with: AMD » Radeon Rx 6600m » Version: N/A
When used together with: AMD » Radeon Rx 6600s » Version: N/A
When used together with: AMD » Radeon Rx 6650 Xt » Version: N/A
When used together with: AMD » Radeon Rx 6650m » Version: N/A
When used together with: AMD » Radeon Rx 6650m Xt » Version: N/A
When used together with: AMD » Radeon Rx 6700 » Version: N/A
When used together with: AMD » Radeon Rx 6700 Xt » Version: N/A
When used together with: AMD » Radeon Rx 6700m » Version: N/A
When used together with: AMD » Radeon Rx 6700s » Version: N/A
When used together with: AMD » Radeon Rx 6750 Gre » Version: N/A
When used together with: AMD » Radeon Rx 6750 Xt » Version: N/A
When used together with: AMD » Radeon Rx 6800 » Version: N/A
When used together with: AMD » Radeon Rx 6800 Xt » Version: N/A
When used together with: AMD » Radeon Rx 6800m » Version: N/A
When used together with: AMD » Radeon Rx 6800s » Version: N/A
When used together with: AMD » Radeon Rx 6850m Xt » Version: N/A
When used together with: AMD » Radeon Rx 6900 Xt » Version: N/A
When used together with: AMD » Radeon Rx 6950 Xt » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2023-31307

EPSS FAQ

0.04%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 9 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-31307

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
2.3	LOW	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L	N/A	N/A	Advanced Micro Devices Inc.	2024-08-13
Attack Vector: Local Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: Low
4.4	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H	0.8	3.6	NIST	2024-12-13
Attack Vector: Local Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High
2.3	LOW	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L	0.8	1.4	Advanced Micro Devices Inc.	2024-08-13
Attack Vector: Local Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: Low

CWE ids for CVE-2023-31307

CWE-129 Improper Validation of Array Index

The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.
Assigned by:
- 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)
- nvd@nist.gov (Primary)

References for CVE-2023-31307

https://www.amd.com/en/resources/product-security/bulletin/amd-sb-6005.html

AMD Graphics Driver Vulnerabilities – August 2024 
Vendor Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2023-31307

Products affected by CVE-2023-31307

Exploit prediction scoring system (EPSS) score for CVE-2023-31307

CVSS scores for CVE-2023-31307

CWE ids for CVE-2023-31307

References for CVE-2023-31307