EUVD-2025-209874
GHSA-mh6f-jq3x-vvpv
CVSS VectorNVD
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionNVD
An unchecked return value within the AMD Platform Management Framework (PMF) could allow an attacker to write to an arbitrary memory address resulting in denial of service or arbitrary code execution.
AnalysisAI
Arbitrary code execution and denial of service in AMD Platform Management Framework (PMF) affects Ryzen 7035, 7040, 8040 mobile processors and Ryzen Embedded 8000 series. A local authenticated attacker exploiting an unchecked return value vulnerability can write to arbitrary memory locations, potentially escalating privileges from low to high integrity across system boundaries. The CVSS 4.0 score of 7.1 reflects local attack vector with low complexity but requires specific attack timing conditions (AT:P), though the cross-scope impact (S:H) and high confidentiality/integrity impact to subsequent systems elevate real-world risk for enterprise environments with AMD mobile processors.
Technical ContextAI
The vulnerability resides in AMD's Platform Management Framework (PMF), a system management software component present in modern Ryzen mobile and embedded processors. The root cause is CWE-252 (Unchecked Return Value), where the software fails to validate the success or failure of a critical operation before proceeding. In C/C++ environments common to system firmware and drivers, unchecked return values from memory allocation, privilege checks, or hardware operations can leave pointers uninitialized or contain unexpected values. When the code subsequently dereferences these unchecked values, an attacker who can influence the failed operation can redirect execution flow or corrupt memory at arbitrary addresses. The affected CPE strings identify specific processor families: Rembrandt-R refresh (7035 series), Phoenix (7040 series), Hawk Point (8040 series), and Ryzen Embedded 8000 series, suggesting the vulnerable PMF code is shared across AMD's 2023-2024 mobile processor lineup. PMF typically operates with elevated system privileges to manage power states, thermal profiles, and performance tuning, making memory corruption vulnerabilities particularly severe.
RemediationAI
Apply AMD-provided firmware and driver updates per Security Bulletin AMD-SB-4015 (https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-4015.html). Specific patch versions not disclosed in available data - consult the bulletin for affected BIOS revisions and PMF driver updates for each processor family. Patches likely address the unchecked return value by adding proper validation logic before memory operations. Workarounds: Restrict local user privileges to trusted accounts only, as exploitation requires low-privileged local access. Deploy endpoint detection and response (EDR) solutions to monitor for suspicious driver interactions or unexpected privilege escalations from user-mode processes. In high-security environments, consider disabling AMD PMF service if power management tuning is not operationally required, though this may impact battery life and thermal performance on mobile systems. Verify patch application through BIOS version checks and driver enumeration (check PMF driver file versions in Windows Device Manager or Linux lsmod output). No compensating network controls are relevant given local attack vector.
More from same product – last 7 days
VM escape in Kata Containers allows any Kubernetes user with pod-creation rights to break out of the VM sandbox and gain
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix watch_id bounds checking in debug a
In the Linux kernel, the following vulnerability has been resolved: ceph: only d_add() negative dentries when they are
In the Linux kernel, the following vulnerability has been resolved: x86/CPU/AMD: Prevent improper isolation of shared r
Share
External POC / Exploit Code
Leaving vuln.today