Vulnerabilidades em AMD

467 resultados
Análise Vexday

O portfólio de vulnerabilidades da AMD reúne 443 CVEs catalogadas, com 59 registros surgidos nos últimos 90 dias, indicando um ritmo de descoberta que merece acompanhamento contínuo. A taxa de exploração ativa está abaixo da média geral do catálogo, com zero entradas no CISA KEV, o que sugere pressão operacional imediata menor em comparação com outros fornecedores. No entanto, a CVE mais perigosa atualmente monitorada, CVE-2023-20588, apresenta o maior EPSS observado no conjunto (0,1241), sinalizando probabilidade não negligenciável de exploração e justificando priorização nas rotinas de patch. A falha mais frequente, CWE-20 (validação inadequada de entrada), reflete uma fragilidade estrutural recorrente no código, enquanto as 6 CVEs de severidade crítica e a existência de pelo menos uma prova de conceito pública reforçam a necessidade de gestão ativa mesmo sem exploração confirmada no momento.

CVE-2023-31330LOWAn out-of-bounds read in the ASP could allow a privileged attacker with access to a malicious bootloader to potentially read sensitive memorEPSS 0.1%CVE-2026-0461HIGHInsufficient boundary validation in the USB boot mode implementation of AMD Zynq™ UltraScale+ MPSoC and RFSoC devices could allow unbounded EPSS 0.1%CVE-2023-20512LOWA hardcoded AES key in PMFW may result in a privileged attacker gaining access to the key, potentially resulting in internal debug informaEPSS 0.1%CVE-2023-31306LOWImproper validation of an array index in the AMD graphics driver software could allow an attacker to pass malformed arguments to the dynamicEPSS 0.1%CVE-2025-0034MEDIUMInsufficient parameter sanitization in TEE SOC Driver could allow an attacker to issue a malformed DRV_SOC_CMD_ID_SRIOV_SPATIAL_PART and cauEPSS 0.1%CVE-2021-26403MEDIUMInsufficient checks in SEV may lead to a malicious hypervisor disclosing the launch secret potentially resulting in compromise of VM confideEPSS 0.1%CVE-2023-31351MEDIUMImproper restriction of operations in the IOMMU could allow a malicious hypervisor to access guest private memory resulting in loss of integEPSS 0.1%CVE-2025-0040MEDIUMImproper access control between the Joint Test Action Group (JTAG) and Advanced Extensible Interface (AXI) could allow an attacker with physEPSS 0.1%CVE-2025-0010MEDIUMAn out of bounds write in the Linux graphics driver could allow an attacker to overflow the buffer potentially resulting in loss of confidenEPSS 0.1%CVE-2025-54514MEDIUMImproper isolation of shared resources on a system on a chip by a malicious local attacker with high privileges could potentially lead to a EPSS 0.1%CVE-2024-36333HIGHA DLL hijacking vulnerability in the AMD Cleanup Utility could allow an attacker to achieve privilege escalation potentially resulting in arEPSS 0.1%CVE-2025-48511MEDIUMImproper input validation within AMD uprof can allow a local attacker to write to an arbitrary physical address, potentially resulting in crEPSS 0.1%CVE-2025-29933MEDIUMImproper input validation within AMD uProf can allow a local attacker to write out of bounds, potentially resulting in a crash or denial of EPSS 0.1%CVE-2025-48502MEDIUMImproper input validation within AMD uprof can allow a local attacker to overwrite MSR registers, potentially resulting in crash or denial oEPSS 0.1%CVE-2025-29934MEDIUMA bug within some AMD CPUs could allow a local admin-privileged attacker to run a SEV-SNP guest using stale TLB entries, potentially resultiEPSS 0.1%CVE-2021-26396MEDIUMInsufficient validation of address mapping to IO in ASP (AMD Secure Processor) may result in a loss of memory integrity in the SNP guest. EPSS 0.1%CVE-2023-31365LOWAn integer overflow in the SMU could allow a privileged attacker to potentially write memory beyond the end of the reserved dRAM area resultEPSS 0.1%CVE-2025-61971MEDIUMMissing lock bit protection for NBIO registers could allow a local admin-privileged attacker to modify MMIO routing configurations, potentiaEPSS 0.1%CVE-2023-20576HIGHInsufficient Verification of Data Authenticity in AGESA™ may allow an attacker to update SPI ROM data potentially resulting in denial of serEPSS 0.1%CVE-2025-0007MEDIUMInsufficient validation within Xilinx Run Time framework could allow a local attacker to escalate privileges from user space to kernel spaceEPSS 0.1%