AMD Radeon GPU Driver EUVD-2025-209877

Attacker must hold high privilege (PR:H - root, hypervisor, or trusted kernel module context) on the system where the GPU is attached. The attacker must have direct access to issue ioctl commands to the TEE SOC driver (typically through /dev/kfd or AMD HSA device files). Attack complexity is high, indicating non-obvious parameter manipulation or specific driver state is required to trigger incorrect mapping behavior. The vulnerability does not affect unauthenticated remote attackers or unprivileged user-space processes unless privilege escalation is separately achieved. Default GPU driver installations without explicit access control restrict /dev/kfd access to root and potentially the GPU group, requiring the attacker to already hold high privilege or exploit a separate privilege-escalation vulnerability.

Despite the low CVSS score of 1.8, this vulnerability presents concentrated risk to high-privilege attack scenarios. The CVSS vector AV:L (local access only), AC:H (high attack complexity), AT:P (requires physical/administrative proximity), PR:H (high privilege required), and VA:L (availability impact only, limited scope) indicates the vulnerability is NOT a widespread network threat. However, several factors elevate real risk: (1) the restriction to PR:H suggests exploitation requires root or hypervisor-level privilege, making it primarily relevant in container escape, hypervisor breakout, or privileged user-initiated scenarios; (2) the tag 'Information Disclosure' conflicts with CVSS impact ratings (VC:N/VI:N/VA:L) - vendor tagging suggests actual impact exceeds CVSS assessment; (3) GPUs in data center environments (Instinct MI-series) are increasingly used for AI workloads with sensitive data, raising the value of memory disclosure; (4) no EPSS, KEV, or POC data provided, so exploitation difficulty and prevalence are unconfirmed. The high complexity and privilege bar significantly reduces practical exploitability for most deployments, but organizations running virtualized GPU compute or multi-tenant environments should assess whether malicious privileged processes could leverage this to access cross-partition memory.

A privileged container process or hypervisor-level attacker with ioctl access to the GPU TEE SOC driver crafts a malformed DRV_SOC_CMD_ID_SRIOV_CHECK_TA_COMPAT command with intentionally invalid shared memory mapping parameters, triggering the driver to create memory mappings outside intended boundaries. The incorrect mapping exposes adjacent GPU or host memory regions, allowing the attacker to read sensitive data such as cryptographic keys, model weights, or other processes' data.