CVE-2023-31348

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A DLL hijacking vulnerability in AMD μProf could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-427 CWE-400

Affected software

Vendor	Product	Versions
AMD	μProf Tool	>= μProf Tool, < 3.4.494
amd	uprof_tool	< 3.4.494

References

https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-9001Vendor Advisory

Timeline

Published: Aug 13, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-313497.8Incorrect default permissions in the AMD μProf installation directory could allow an attacker to achieve privilege escalation, potentially r CVE-2023-31356.1The Mailtree Log Mail plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and includin CVE-2023-313515.3Improper restriction of operations in the IOMMU could allow a malicious hypervisor to access guest private memory resulting in loss of integ CVE-2023-313526.0A bug in the SEV firmware may allow an attacker with privileges to read unencrypted memory, potentially resulting in loss of guest private d CVE-2023-313556.0Improper restriction of write operations in SNP firmware could allow a malicious hypervisor to overwrite a guest's UMC seed potentially allo CVE-2023-313564.4Incomplete system memory cleanup in SEV firmware could allow a privileged attacker to corrupt guest private memory, potentially resulting in CVE-2023-313587.8A DLL hijacking vulnerability in the AMD Manageability API could allow an attacker to achieve privilege escalation, potentially resulting in CVE-2023-313597.8Incorrect default permissions in the AMD Manageability API could allow an attacker to achieve privilege escalation, potentially resulting in CVE-2023-31366.1The MailArchiver plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 2.CVE-2023-313607.3Incorrect default permissions in the AMD Integrated Management Technology (AIM-T) Manageability Service installation directory could allow a CVE-2023-313617.3A DLL hijacking vulnerability in AMD Integrated Management Technology (AIM-T) Manageability Service could allow an attacker to achieve privi CVE-2023-313648.3Improper handling of direct memory writes in the input-output memory management unit could allow a malicious guest virtual machine (VM) to f