EUVD-2025-209865
GHSA-mcj8-g2g4-fg5g
CVSS VectorNVD
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionNVD
An improper input validation vulnerability within the AMD Platform Management Framework (PMF) driver can allow a local attacker to read Out-of-Bounds potentially resulting in information disclosure or a crash
AnalysisAI
Improper input validation in the AMD Platform Management Framework (PMF) driver allows local authenticated attackers to read out-of-bounds memory, resulting in information disclosure or denial of service. The vulnerability affects multiple Ryzen processor families (7035, 7040, 8040, 6000 series, and Embedded 8000) and requires local access with limited privileges to exploit.
Technical ContextAI
The AMD Platform Management Framework is a firmware/driver component responsible for managing power, thermal, and other platform settings on AMD Ryzen processors. CWE-125 (Out-of-Bounds Read) indicates the vulnerability stems from improper validation of user-supplied input before memory access operations. The flaw likely exists in an ioctl handler or memory-mapped interface exposed by the PMF driver, where an attacker can craft malicious requests to cause the driver to read memory regions outside intended boundaries. This is distinct from a write vulnerability - the attacker cannot modify kernel memory but can exfiltrate sensitive data from adjacent memory regions.
RemediationAI
Update AMD Platform Management Framework to version 7.06.02.123 or later. For AMD Ryzen Embedded 8000 Series, apply the patched amd_chipset_software_7.06.02.123.exe. For other Ryzen families, retrieve the chipset driver package from AMD's support website that includes PMF version 7.06.02.123 and install according to AMD's guidance. If immediate patching is not possible, restrict local user access to the system or disable non-essential local accounts; however, this is a partial mitigation only, as the vulnerability requires low privileges (authenticated local user). No workarounds are documented in the advisory to disable the vulnerable PMF feature without breaking platform functionality. Prioritize patching for multi-user systems and systems that handle sensitive data accessible to kernel memory.
More from same product – last 7 days
VM escape in Kata Containers allows any Kubernetes user with pod-creation rights to break out of the VM sandbox and gain
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix watch_id bounds checking in debug a
In the Linux kernel, the following vulnerability has been resolved: ceph: only d_add() negative dentries when they are
In the Linux kernel, the following vulnerability has been resolved: x86/CPU/AMD: Prevent improper isolation of shared r
Share
External POC / Exploit Code
Leaving vuln.today