CVE-2024-21937

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Incorrect default permissions in the AMD HIP SDK installation directory could allow an attacker to achieve privilege escalation potentially resulting in arbitrary code execution.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-276

Affected software

Vendor	Product	Versions
AMD	AMD Software: PRO Edition	< 24.10.16; < 24.Q2 (24.10.20)
AMD	AMD Software: Adrenalin Edition	< 24.6.1 (24.10.21.01)
AMD	AMD Software: Cloud Edition	< 24.7.1
amd	amd_software_pro_edition	< 24.10.16; < 24.q2_24.10.20
amd	amd_software_adrenalin_edition	< 24.6.1_24.10.21.01
amd	amd_software_cloud_edition	< 24.7.1

References

https://www.amd.com/en/resources/product-security/bulletin/amd-sb-6015.htmlVendor Advisory

Timeline

Published: Nov 12, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-219387.8Incorrect default permissions in the AMD Management Plugin for the Microsoft® System Center Configuration Manager (SCCM) installation direct CVE-2024-219397.3Incorrect default permissions in the AMD Cloud Manageability Service (ACMS) Software installation directory could allow an attacker to achie CVE-2024-21947.2The WP Statistics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the URL search parameter in all versions up to, and CVE-2024-219445.3Improper input validation for DIMM serial presence detect (SPD) metadata could allow an attacker with physical access, ring0 access on a sys CVE-2024-219457.3Incorrect default permissions in the AMD RyzenTM Master monitoring SDK installation directory could allow an attacker to achieve privilege e CVE-2024-219467.3Incorrect default permissions in the AMD RyzenTM Master Utility installation directory could allow an attacker to achieve privilege escalati CVE-2024-219477.5Improper input validation in the system management mode (SMM) could allow a privileged attacker to overwrite arbitrary memory potentially re CVE-2024-219495.5Improper validation of user input in the NPU driver could allow an attacker to provide a buffer with unexpected size, potentially leading to CVE-2024-21959.8A critical Remote Code Execution (RCE) vulnerability was identified in the aimhubio/aim project, specifically within the `/api/runs/search/r CVE-2024-219501.8An out of bounds read in the remote management firmware could allow a privileged attacker read a limited section of memory outside of establ CVE-2024-219535.9Improper input validation in IOMMU could allow a malicious hypervisor to reconfigure IOMMU registers resulting in loss of guest data integri CVE-2024-219547.0Improper exception handling in IOMMU could allow an invalidate command to be sent to PCIe devices that do not support Address Translation Ca