High severity · published Nov 12, 2024
CVE-2024-21937
Incorrect default permissions in the AMD HIP SDK installation directory could allow an attacker to achieve privilege escalation potentially resulting in arbitrary code execution
7.8
CVSS
0.3%
EPSS
No
On KEV
Description
Incorrect default permissions in the AMD HIP SDK installation directory could allow an attacker to achieve privilege escalation potentially resulting in arbitrary code execution.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 18% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AS
AMD Software: Adrenalin Edition · AMD
before 24.6.1 (24.10.21.01) · source: vendor
AS
AMD Software: Cloud Edition · AMD
before 24.7.1 · source: vendor
AS
AMD Software: PRO Edition · AMD
before 24.10.16; before 24.Q2 (24.10.20) · source: vendor
RS
Radeon Software · Amd
before 24.6.1; before 24.7.1; before 24.q2 · source: NVD
RS
Radeon Software For Hip · Amd
before 24.10.16 · source: NVD
AS
Amd Software Adrenalin Edition · Amd
before 24.6.1_24.10.21.01 · source: CISA
AS
Amd Software Cloud Edition · Amd
before 24.7.1 · source: CISA
AS
Amd Software Pro Edition · Amd
before 24.10.16; before 24.q2_24.10.20 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-21937
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-21937
Vendor Advisory
https://www.amd.com/en/resources/product-security/bulletin/amd-sb-6015.html
More from AMD Software: Adrenalin Edition
5.3
CVE-2024-21979
An out of bounds write vulnerability in the AMD Radeon™ user mode driver for DirectX® 11 could allow an attacker with access to a malformed shader to potentially achieve arbitrary…
5.3
CVE-2024-21972
An out of bounds write vulnerability in the AMD Radeon™ user mode driver for DirectX® 11 could allow an attacker with access to a malformed shader to potentially achieve arbitrary…