Amd Instinct Mi250
Monthly
Attacker-controlled pointer dereference in AMD's ROCm Communication Collectives Library (RCCL) can escalate to remote code execution when a compromised peer rank - or a network-adjacent attacker on the collective fabric - participates in a multi-GPU or multi-node distributed workload. The defect (CWE-822, untrusted pointer dereference) affects RCCL running on AMD Instinct MI200/MI300/MI350-class accelerators and carries a CVSS 4.0 base score of 7.7 (vector AV:N/AC:H/AT:N/PR:L/UI:N, High confidentiality/integrity/availability), mapping to an assessed CVSS 3.1 of AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. Exploitation is not confirmed as active (CVE is not in CISA KEV) and no public exploit code has been identified at time of analysis; the attack requires a pre-existing foothold as a peer rank inside the collective group rather than anonymous internet access, so this is a moderate-priority issue for distributed AMD GPU deployments rather than an internet-wide emergency.
Remote unauthenticated manipulation of AMD Instinct GPU configuration is possible in the AMD Device Metrics Exporter (DME), a ROCm-ecosystem monitoring component, because the service binds to an unrestricted IP address and exposes its control surface network-wide. Any attacker able to reach the listening port can push unauthorized GPU configuration changes, degrading or denying availability of the affected AMD Instinct MI-series accelerator (MI210/MI250/MI250X/MI300A/MI300X/MI308X/MI325X/MI350X/MI355X). No public exploit is identified at time of analysis, and EPSS is low (0.20%), but the CVSS 4.0 base score of 9.2 reflects trivial network reachability with high availability impact.
Heap-based buffer overflow in AMD's MxGPU-Virtualization (GIM) driver affects a range of AMD Instinct and Radeon PRO datacenter GPUs, allowing a local low-privileged attacker to trigger denial-of-service by exploiting a race condition on the global variable amdgv_cmd in an unsynchronized ioctl handler. AMD has issued Security Bulletin AMD-SB-6027 confirming the issue and releasing GIM Driver 8.4 for affected Instinct-series products; no public exploit code exists and the vulnerability is not listed in CISA KEV. With EPSS at 0.01% (2nd percentile) and CVSS 4.0 score of 2.0, this represents a very low real-world exploitation priority despite the heap overflow classification.
Improper privilege validation in AMD Secure Processor (ASP) allows authenticated local attackers to write data to restricted memory regions, compromising data integrity and potentially affecting system availability. The vulnerability affects AMD MI-25, MI250, MI210 accelerators and AMD Radeon Pro V520/V620 GPUs. No public exploit code has been identified, but the low attack complexity and authenticated network access vector indicate moderate real-world risk in data center and AI/ML environments where these devices are deployed.
Buffer overflow in AMD GPU driver IOCTL handler enables local privilege escalation to root on Linux systems running AMD Instinct or Radeon Pro GPUs. Authenticated local users with low privileges can exploit an out-of-bounds write vulnerability in the AMDGV_CMD_GET_DIAG_DATA IOCTL to achieve arbitrary kernel code execution. EPSS data not available; no public exploit or CISA KEV listing identified at time of analysis, suggesting limited active exploitation despite high CVSS 8.5 severity.
Insufficient parameter sanitization in the AMD TEE SOC Driver's DRV_SOC_CMD_ID_SRIOV_CHECK_TA_COMPAT command handler allows high-privileged local attackers to trigger incorrect shared memory mapping via malformed parameters, potentially disclosing sensitive information. The vulnerability affects AMD Radeon RX 6000/7000, Radeon Pro W6000/W7000, and Instinct MI-series GPUs. CVSS 1.8 reflects high-privilege requirement and local-only attack vector with severe attack complexity, but the information disclosure impact and active vendor acknowledgment indicate targeted risk to privileged processes.
A TOCTOU (Time-Of-Check to Time-Of-Use) in the graphics interface may allow an attacker to load registers repeatedly creating a race condition potentially leading to a loss of integrity. Rated low severity (CVSS 1.8). No vendor patch available.
Attacker-controlled pointer dereference in AMD's ROCm Communication Collectives Library (RCCL) can escalate to remote code execution when a compromised peer rank - or a network-adjacent attacker on the collective fabric - participates in a multi-GPU or multi-node distributed workload. The defect (CWE-822, untrusted pointer dereference) affects RCCL running on AMD Instinct MI200/MI300/MI350-class accelerators and carries a CVSS 4.0 base score of 7.7 (vector AV:N/AC:H/AT:N/PR:L/UI:N, High confidentiality/integrity/availability), mapping to an assessed CVSS 3.1 of AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. Exploitation is not confirmed as active (CVE is not in CISA KEV) and no public exploit code has been identified at time of analysis; the attack requires a pre-existing foothold as a peer rank inside the collective group rather than anonymous internet access, so this is a moderate-priority issue for distributed AMD GPU deployments rather than an internet-wide emergency.
Remote unauthenticated manipulation of AMD Instinct GPU configuration is possible in the AMD Device Metrics Exporter (DME), a ROCm-ecosystem monitoring component, because the service binds to an unrestricted IP address and exposes its control surface network-wide. Any attacker able to reach the listening port can push unauthorized GPU configuration changes, degrading or denying availability of the affected AMD Instinct MI-series accelerator (MI210/MI250/MI250X/MI300A/MI300X/MI308X/MI325X/MI350X/MI355X). No public exploit is identified at time of analysis, and EPSS is low (0.20%), but the CVSS 4.0 base score of 9.2 reflects trivial network reachability with high availability impact.
Heap-based buffer overflow in AMD's MxGPU-Virtualization (GIM) driver affects a range of AMD Instinct and Radeon PRO datacenter GPUs, allowing a local low-privileged attacker to trigger denial-of-service by exploiting a race condition on the global variable amdgv_cmd in an unsynchronized ioctl handler. AMD has issued Security Bulletin AMD-SB-6027 confirming the issue and releasing GIM Driver 8.4 for affected Instinct-series products; no public exploit code exists and the vulnerability is not listed in CISA KEV. With EPSS at 0.01% (2nd percentile) and CVSS 4.0 score of 2.0, this represents a very low real-world exploitation priority despite the heap overflow classification.
Improper privilege validation in AMD Secure Processor (ASP) allows authenticated local attackers to write data to restricted memory regions, compromising data integrity and potentially affecting system availability. The vulnerability affects AMD MI-25, MI250, MI210 accelerators and AMD Radeon Pro V520/V620 GPUs. No public exploit code has been identified, but the low attack complexity and authenticated network access vector indicate moderate real-world risk in data center and AI/ML environments where these devices are deployed.
Buffer overflow in AMD GPU driver IOCTL handler enables local privilege escalation to root on Linux systems running AMD Instinct or Radeon Pro GPUs. Authenticated local users with low privileges can exploit an out-of-bounds write vulnerability in the AMDGV_CMD_GET_DIAG_DATA IOCTL to achieve arbitrary kernel code execution. EPSS data not available; no public exploit or CISA KEV listing identified at time of analysis, suggesting limited active exploitation despite high CVSS 8.5 severity.
Insufficient parameter sanitization in the AMD TEE SOC Driver's DRV_SOC_CMD_ID_SRIOV_CHECK_TA_COMPAT command handler allows high-privileged local attackers to trigger incorrect shared memory mapping via malformed parameters, potentially disclosing sensitive information. The vulnerability affects AMD Radeon RX 6000/7000, Radeon Pro W6000/W7000, and Instinct MI-series GPUs. CVSS 1.8 reflects high-privilege requirement and local-only attack vector with severe attack complexity, but the information disclosure impact and active vendor acknowledgment indicate targeted risk to privileged processes.
A TOCTOU (Time-Of-Check to Time-Of-Use) in the graphics interface may allow an attacker to load registers repeatedly creating a race condition potentially leading to a loss of integrity. Rated low severity (CVSS 1.8). No vendor patch available.