CVE-2023-20598: amd radeon_software Improper Privilege Management

Vulnerability summary

CVE-2023-20598 is a high (CVSS 7.8) Improper Privilege Management vulnerability in amd radeon_software. EPSS estimates a 0.44% chance of exploitation in the next 30 days, higher than 36.6% of scored vulnerabilities.

Timeline

1. 17-10-2023
   PublishedVulnerability first disclosed.
2. 02-08-2024
   Last modifiedVulnerability information updated.

Description

An improper privilege management in the AMD Radeon™ Graphics driver may allow an authenticated attacker to craft an IOCTL request to gain I/O control over arbitrary hardware ports or physical addresses resulting in a potential arbitrary code execution.

• CWE-269Improper Privilege ManagementThe product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.