AMD Instinct GPU CVE-2025-54517

Exploitation requires authenticated local user access with low privileges (PR:L) to a Linux system with affected AMD Instinct or Radeon Pro GPU hardware installed and the vulnerable AMD GPU kernel driver loaded. The attacker must have permission to interact with the GPU device nodes (typically /dev/kfd or /dev/dri/* devices) through the IOCTL interface, which is commonly granted to users in the 'video' or 'render' groups on standard Linux configurations. No user interaction (UI:N) or special non-default configurations are required beyond standard GPU driver installation. The vulnerability affects default driver configurations when diagnostic IOCTL handlers are enabled, which is typical for production deployments. Physical or remote shell access to the target system is the primary prerequisite. Network-based remote exploitation (AV:L) is not possible without first compromising a local account through other means.

Real-world risk is elevated but context-dependent. CVSS 4.0 vector (AV:L/AC:L/PR:L) indicates local access with low privileges required and low attack complexity, achieving high confidentiality, integrity, and availability impact. The scope parameter (SC:N/SI:N/SA:N) confirms no impact beyond the vulnerable component, meaning privilege escalation stops at kernel level rather than escaping hypervisor boundaries. This is critical for enterprises deploying these GPUs: local privilege escalation to root/kernel is severe for multi-tenant compute clusters, container environments, or systems with multiple user accounts, but the attacker must already have local authenticated access. No EPSS score available for risk quantification. Absence from CISA KEV and lack of public exploit code suggests exploitation is not yet widespread, but AMD's disclosure indicates the vendor has confirmed exploitability. Priority depends heavily on deployment context: highest risk in shared HPC clusters, academic compute environments, or cloud GPU instances where multiple users have shell access; lower risk for single-tenant dedicated GPU servers with restricted physical/remote access. The requirement for authenticated local access significantly reduces attack surface compared to network-exploitable vulnerabilities.

An authenticated user with standard (non-root) account access on a Linux system with AMD Instinct or Radeon Pro GPU installed crafts a malicious IOCTL call to the GPU driver's AMDGV_CMD_GET_DIAG_DATA diagnostic interface with specially formatted parameters. The out-of-bounds write triggered by this IOCTL overwrites adjacent kernel memory structures, allowing the attacker to inject and execute arbitrary code with kernel privileges, achieving full root access to the system. No public proof-of-concept code has been identified at time of analysis, but the low attack complexity suggests exploitation is feasible for moderately skilled attackers once vulnerability details are analyzed.