AMD Platform Management Framework CVE-2025-29938

Exploitation requires local authenticated access with low-level user privileges (PR:L) on systems running affected AMD Ryzen 7035/7040/8040 mobile or Embedded 8000 series processors with AMD Platform Management Framework drivers installed. The CVSS AT:P (Attack Timing: Present) metric indicates the attacker must exploit specific timing windows or race conditions within the PMF driver - likely requiring the ability to make rapid repeated calls to PMF interfaces while manipulating system state to trigger the unchecked return value path. Standard user privileges are sufficient, but the attacker likely needs ability to load or interact with AMD PMF driver interfaces, which may be restricted on hardened systems. No network access, physical access, or user interaction required once local access is established. Exploitation is limited to AMD systems with PMF software component active, not Intel or other AMD processor families outside the specified CPE ranges.

Real-world risk is elevated despite the local attack vector. The CVSS 4.0 vector indicates low privilege requirements (PR:L) but highlights critical cross-scope impact (SC:H/SI:H/SA:H), meaning a low-privileged attacker can achieve high confidentiality, integrity, and availability impact on subsequent systems or security contexts. The AT:P (Attack Timing: Present) metric suggests exploitation requires specific race conditions or timing windows, increasing complexity slightly. No EPSS score, KEV status, or POC availability data is provided, suggesting this is a recent disclosure without confirmed public exploitation at time of analysis. However, AMD's direct disclosure via security bulletin AMD-SB-4015 confirms vendor awareness and likely customer-reported incidents. The SSVC framework would classify this as high technical impact (arbitrary code execution with privilege escalation potential) but exploitation status uncertain. Primary risk lies in enterprise environments with AMD mobile workstations where local attackers (malicious insiders, malware with user-level access) could escalate to kernel/firmware privileges. Missing data: EPSS probability, patch testing timeline, exploit prerequisites beyond 'specific timing'.

A malicious insider or malware running with standard user privileges on an enterprise laptop with AMD Ryzen 7040 processor triggers a failure condition in the PMF driver's memory allocation routine. By manipulating timing through repeated driver calls, the attacker causes a return value check to be skipped. The PMF code then treats an uninitialized pointer as valid, allowing the attacker to specify an arbitrary memory address for a subsequent write operation. This memory corruption overwrites kernel data structures or firmware variables, allowing the attacker to escalate privileges to SYSTEM/root and achieve persistence across reboots by modifying UEFI variables.