CVE-2023-31305

LowCVSS 1.9/10Last modified Jun 17, 2026

Description

Generation of weak and predictable Initialization Vector (IV) in PMFW (Power Management Firmware) may allow an attacker with privileges to reuse IV values to reverse-engineer debug data, potentially resulting in information disclosure.

Metrics

CVSS 3.1 1.9/10CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-338

Affected software

Vendor	Product	Versions
AMD	AMD Radeon™ RX 6000 Series Graphics Cards	—
AMD	AMD Radeon™ PRO W6000 Series Graphics Cards	—

References

https://www.amd.com/en/resources/product-security/bulletin/amd-sb-6005.html

Timeline

Published: Aug 13, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2023

CVE-2023-313063.3Improper validation of an array index in the AMD graphics driver software could allow an attacker to pass malformed arguments to the dynamic CVE-2023-313074.4Improper validation of array index in Power Management Firmware (PMFW) may allow a privileged attacker to cause an out-of-bounds memory read CVE-2023-313083.3A malicious virtual function can invoke the certain command handlers in the SMU, causing a denial of service due to out-of-bounds memory rea CVE-2023-313096.8Improper validation in Power Management Firmware (PMFW) may allow an attacker with privileges to pass malformed workload arguments when expo CVE-2023-31314.3The MStore API WordPress plugin before 3.9.7 does not secure most of its AJAX actions by implementing privilege checks, nonce checks, or a c CVE-2023-313105.0Improper input validation in Power Management Firmware (PMFW) may allow an attacker with privileges to send a malformed input for the "set t CVE-2023-313137.2An unintended proxy or intermediary in the AMD power management firmware (PMFW) could allow a privileged attacker to send malformed messages CVE-2023-313157.5Improper validation in a model specific register (MSR) could allow a malicious program with ring0 access to modify SMM configuration while S CVE-2023-313167.1Improperly preserved integrity of hardware configuration state during a power save/restore operation in the AMD Secure Processor (ASP) could CVE-2023-313178.8Improper restriction of operations within the bounds of a memory buffer in the AMD secure processer (ASP) could allow an attacker to read or CVE-2023-31327.5The MainWP Child plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.4.1.1 due to insuf CVE-2023-313207.5Improper input validation in the AMD RadeonTM Graphics display driver may allow an attacker to corrupt the display potentially resulting in