EUVD-2025-209876
GHSA-gm2x-9p5x-p992
CVSS VectorNVD
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionNVD
Insufficient parameter sanitization in AMD Secure Processor (ASP) TEE SOC Driver could allow an attacker to issue a malformed DRV_SOC_CMD_ID_LOAD_GFX_IP_FW SR-IOV command to cause out-of-bounds read, potentially resulting in SOC Driver memory contents exposure or an exception
AnalysisAI
Out-of-bounds read in AMD Secure Processor TEE SOC Driver allows high-privileged local attackers to trigger memory exposure or denial of service via malformed SR-IOV commands on Radeon RX 6000/7000, Pro W6000/W7000, and Instinct MI-series GPUs. Insufficient parameter sanitization in the DRV_SOC_CMD_ID_LOAD_GFX_IP_FW command handler permits crafted input to bypass bounds checks, exposing SOC Driver memory or causing exceptions. Attack requires high privilege level (PR:H) and local access (AV:L), limiting real-world exploitation to compromised administrative contexts or supply-chain scenarios.
Technical ContextAI
The AMD Secure Processor (ASP) is a dedicated Trusted Execution Environment (TEE) microcontroller integrated into AMD RDNA and CDNA GPUs, responsible for security-critical operations including firmware loading and validation. The SOC (System-on-Chip) Driver provides an interface between the host OS and the ASP, including SR-IOV (Single-Root I/O Virtualization) command channels for virtual machine contexts. The vulnerability resides in the DRV_SOC_CMD_ID_LOAD_GFX_IP_FW command handler, which processes firmware image load requests. The root cause is insufficient sanitization of command parameters before use in memory access operations, classified as CWE-125 (Out-of-Bounds Read). When a malformed SR-IOV command with invalid size or offset parameters reaches the handler, it bypasses bounds validation, permitting reads beyond allocated buffer boundaries. The affected GPUs span consumer (Radeon RX 6000/7000), professional (Pro W6000/W7000), and data-center (Instinct MI-series) product lines, all sharing the same ASP firmware architecture.
RemediationAI
AMD has released a security bulletin (AMD-SB-6027) documenting this vulnerability; consult that bulletin for specific firmware version recommendations and update procedures specific to each product line. Contact AMD support or visit https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-6027.html for detailed patching instructions and firmware availability by product series. For data-center environments (Instinct MI-series), coordinate updates with system firmware and driver update cycles to minimize downtime. If firmware updates are not yet available or cannot be immediately deployed, restrict SR-IOV virtual machine creation and guest GPU assignment to trusted administrative domains only, or disable GPU virtualization features entirely if the use case permits. Note that this vulnerability requires high privilege level (root/SYSTEM equivalent) on the host system, so it does not pose a risk from unprivileged guest VMs in properly isolated virtualization environments; however, guest-to-host escalation chains should be evaluated holistically with this flaw in mind.
More from same product – last 7 days
VM escape in Kata Containers allows any Kubernetes user with pod-creation rights to break out of the VM sandbox and gain
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix watch_id bounds checking in debug a
In the Linux kernel, the following vulnerability has been resolved: ceph: only d_add() negative dentries when they are
In the Linux kernel, the following vulnerability has been resolved: x86/CPU/AMD: Prevent improper isolation of shared r
Share
External POC / Exploit Code
Leaving vuln.today