CVE-2022-23831

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Insufficient validation of the IOCTL input buffer in AMD μProf may allow an attacker to send an arbitrary buffer leading to a potential Windows kernel crash resulting in denial of service.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
AMD	AMD μProf	>= AMDuProf_FreeBSD_x64, < 3.6.549; >= AMDuProf Windows, < 3.6.839; >= AMDuProf Linux, < 3.6-449

References

https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1046Vendor Advisory
https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1046Vendor Advisory

Timeline

Published: Nov 9, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-238337.5An issue was discovered in MultiPartParser in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2. Passing certain inputs to m CVE-2022-238358.1The Visual Voice Mail (VVM) application through 2022-02-24 for Android allows persistent access if an attacker temporarily controls an appli CVE-2022-238377.5In api.rb in Sidekiq before 5.2.10 and 6.4.0, there is no limit on the number of days when requesting stats for the graph. This overloads th CVE-2022-23844.8The Digital Publications by Supsystic WordPress plugin before 1.7.4 does not sanitise and escape its settings, allowing high privilege users CVE-2022-238489.8In Alluxio before 2.7.3, the logserver does not validate the input stream. NOTE: this is not the same as the CVE-2021-44228 Log4j vulnerabil CVE-2022-238496.6The biometric lock in Devolutions Password Hub for iOS before 2021.3.4 allows attackers to access the application because of authentication CVE-2022-23858.8A security issue was discovered in aws-iam-authenticator where an allow-listed IAM identity may be able to modify their username and escalat CVE-2022-238507.8xhtml_translate_entity in xhtml.c in epub2txt (aka epub2txt2) through 2.02 allows a stack-based buffer overflow via a crafted EPUB document.CVE-2022-238519.8Netaxis API Orchestrator (APIO) before 0.19.3 allows server side template injection (SSTI).CVE-2022-238529.8Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.CVE-2022-238537.8The LSP (Language Server Protocol) plugin in KDE Kate before 21.12.2 and KTextEditor before 5.91.0 tries to execute the associated LSP serve CVE-2022-238547.5AVEVA InTouch Access Anywhere versions 2020 R2 and older are vulnerable to a path traversal exploit that could allow an unauthenticated user