CVE-2021-26334: vulnerability in AMD μProf Tool
AMD Chipset Driver Information Disclosure Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
A flaw in AMD's performance profiling driver allows low-privilege users to access sensitive hardware registers, potentially allowing them to run code with the highest system permissions.
The AMDPowerProfiler.sys driver fails to enforce proper privilege checks when accessing Model-Specific Registers (MSRs) in kernel mode, allowing unprivileged local users to read/write kernel-level hardware state. This CWE-284 authorization bypass enables privilege escalation and ring-0 code execution on affected systems running AMD μProf.
In the same product, most dangerous first.