CVE-2025-0034

MediumCVSS 4.7/10Last modified Oct 18, 2026

Description

Insufficient parameter sanitization in TEE SOC Driver could allow an attacker to issue a malformed DRV_SOC_CMD_ID_SRIOV_SPATIAL_PART and cause read or write past the end of allocated arrays, potentially resulting in a loss of platform integrity or denial of service.

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
AMD	AMD Instinct™ MI300X	—
AMD	AMD Instinct™ MI325X	—

References

https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-6018.html

Timeline

Published: Sep 6, 2025
Last modified: Oct 18, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-00357.3Unquoted search path within AMD Cloud Manageability Service can allow a local attacker to escalate privileges, potentially resulting in arbi CVE-2025-00363.2In AMD Versal Adaptive SoC devices, the incorrect configuration of the SSS during runtime (post-boot) cryptographic operations could cause d CVE-2025-00376.6In AMD Versal Adaptive SoC devices, the lack of address validation when executing PLM runtime services through the PLM firmware can allow ac CVE-2025-00386.6In AMD Zynq UltraScale+ devices, the lack of address validation when executing CSU runtime services through the PMU Firmware can allow acces CVE-2025-00405.3Improper access control between the Joint Test Action Group (JTAG) and Advanced Extensible Interface (AXI) could allow an attacker with phys CVE-2025-00414.6Uncontrolled search paths in the Vitis™ Embedded Single File Download (SFD) for local Windows installation could allow a low-privileged user CVE-2025-00437.0Incorrect directory permissions within AMD Vivado™ Lab Solutions could allow a local user-privileged attacker to escalate their privileges, CVE-2025-00444.8An out-of-bounds read in power management firmware by a malicious local attacker with low privileges could potentially lead to a partial los CVE-2025-00456.9Improper Input validation in the AMD Secure Processor (ASP) PCI driver may allow a local attacker to create a buffer overflow condition, pot CVE-2025-00467.0Incorrect directory permissions could allow a local user to escalate their privileges, potentially resulting in arbitrary code execution.CVE-2025-00494.3When a Web User without Create permission on subfolders attempts to upload a file to a non-existent directory, the error message includes th CVE-2025-00505.9Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Arm Ltd Bifrost GPU Userspace Driver, Arm Ltd Valha