CVE-2023-20562

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Insufficient validation in the IOCTL (Input Output Control) input buffer in AMD uProf may allow an authenticated user to load an unsigned driver potentially leading to arbitrary kernel execution.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published: Aug 8, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-205637.8Insufficient protections in System Management Mode (SMM) code may allow an attacker to potentially enable escalation of privilege via local CVE-2023-205646.7Insufficient validation in the IOCTL (Input Output Control) input buffer in AMD Ryzen™ Master may permit a privileged attacker to perform me CVE-2023-205657.8Insufficient protections in System Management Mode (SMM) code may allow an attacker to potentially enable escalation of privilege via local CVE-2023-205667.5Improper address validation in ASP with SNP enabled may potentially allow an attacker to compromise guest memory integrity.CVE-2023-205676.7Improper signature verification of RadeonTM RX Vega M Graphics driver for Windows may allow an attacker with admin privileges to launch AMDS CVE-2023-205686.7Improper signature verification of RadeonTM RX Vega M Graphics driver for Windows may allow an attacker with admin privileges to launch Rade CVE-2023-205694.7A side channel vulnerability on some of the AMD CPUs may allow an attacker to influence the return address prediction. This may result in sp CVE-2023-20576.1A vulnerability was found in EyouCms 1.5.4. It has been classified as problematic. Affected is an unknown function of the file login.php?m=a CVE-2023-205703.3Insufficient verification of data authenticity in the configuration state machine may allow a local attacker to potentially load arbitrary b CVE-2023-205718.1A race condition in System Management Mode (SMM) code may allow an attacker using a compromised user space to leverage CVE-2018-8897 potenti CVE-2023-205725.6An observable timing discrepancy in the ASP could allow a privileged attacker to perform a brute-force attack against the hash message authe CVE-2023-205733.2A privileged attacker can prevent delivery of debug exceptions to SEV-SNP guests potentially resulting in guests not receiving expected debu