CVE-2023-31349

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Incorrect default permissions in the AMD μProf installation directory could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-276

Affected software

Vendor	Product	Versions
AMD	μProf Tool	>= μProf Tool, < 3.4.494
amd	amd_uprof	< 3.4.494

References

https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-9001Vendor Advisory

Timeline

Published: Aug 13, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-31356.1The Mailtree Log Mail plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and includin CVE-2023-313515.3Improper restriction of operations in the IOMMU could allow a malicious hypervisor to access guest private memory resulting in loss of integ CVE-2023-313526.0A bug in the SEV firmware may allow an attacker with privileges to read unencrypted memory, potentially resulting in loss of guest private d CVE-2023-313556.0Improper restriction of write operations in SNP firmware could allow a malicious hypervisor to overwrite a guest's UMC seed potentially allo CVE-2023-313564.4Incomplete system memory cleanup in SEV firmware could allow a privileged attacker to corrupt guest private memory, potentially resulting in CVE-2023-313587.8A DLL hijacking vulnerability in the AMD Manageability API could allow an attacker to achieve privilege escalation, potentially resulting in CVE-2023-313597.8Incorrect default permissions in the AMD Manageability API could allow an attacker to achieve privilege escalation, potentially resulting in CVE-2023-31366.1The MailArchiver plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 2.CVE-2023-313607.3Incorrect default permissions in the AMD Integrated Management Technology (AIM-T) Manageability Service installation directory could allow a CVE-2023-313617.3A DLL hijacking vulnerability in AMD Integrated Management Technology (AIM-T) Manageability Service could allow an attacker to achieve privi CVE-2023-313648.3Improper handling of direct memory writes in the input-output memory management unit could allow a malicious guest virtual machine (VM) to f CVE-2023-313653.9An integer overflow in the SMU could allow a privileged attacker to potentially write memory beyond the end of the reserved dRAM area result