CVE-2021-26334CWE-284

AMD Chipset Driver Information Disclosure Vulnerability

published December 1, 2021

CVSS
—
EPSS
1%
Percentile
68.1
In the wild
Unconfirmed
What it is

⚠️ A misconfiguration in the AMDPowerProfiler.sys driver could let lower-privileged users sneak into kernel territory — kind of like a junior chef suddenly getting the keys to the kitchen! Think of it like a restaurant where a busboy accidentally learns the secret recipe because the head chef left the door to the kitchen wide open. Lower privileged users might end up accessing critical machine states that should be off-limits! If exploited, this flaw could allow a lower-privileged user to escalate their privileges, potentially gaining full control over the system. Imagine a busboy who now has the chef's hat and the power to change the entire menu — that's a recipe for disaster!

Put simply

Think of it like a restaurant where a busboy accidentally learns the secret recipe because the head chef left the door to the kitchen wide open. Lower privileged users might end up accessing critical machine states that should be off-limits! This vulnerability in the AMD μProf tool's driver permits unauthorized access to model-specific registers (MSRs) by users with lower privileges, paving the way for possible privilege escalation and unrestricted code execution at kernel level.

What to do

If exploited, this flaw could allow a lower-privileged user to escalate their privileges, potentially gaining full control over the system. Imagine a busboy who now has the chef's hat and the power to change the entire menu — that's a recipe for disaster! To neutralize this risk, ensure the AMD μProf tool is updated to the latest version. Regularly audit permissions and monitor access to sensitive components to prevent unauthorized usage. Together, we can keep that kitchen safe! You've got this! Tackle the updates and keep your system secure. 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01208 · 68.1th percentile
Weakness
CWE-284 · Improper Access Control
Published
2021-12-01T15:43Z
EPSS history
Timeline
  • 01 DEC 15:43Z
    AMD Chipset Driver Information Disclosure Vulnerability
    cvelistv5