SB2025040411 - Multiple vulnerabilities in AMD Ryzen AI Software
Published: April 4, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 secuirty vulnerabilities.
1) Incorrect default permissions (CVE-ID: CVE-2025-0014)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to incorrect default permissions for files and folders that are set by the application. A local user can execute arbitrary code on the system with elevated privileges.
2) Integer overflow (CVE-ID: CVE-2024-36337)
The vulnerability allows a local user to execute arbitrary code on the target system.
The vulnerability exists due to integer overflow within AMD NPU Driver. A local user can pass specially crafted data to the application, trigger integer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
3) Integer overflow (CVE-ID: CVE-2024-36328)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to integer overflow within AMD NPU Driver. A local user can pass specially crafted data to the application, trigger integer overflow and cause a denial of service condition on the target system.
4) Integer overflow (CVE-ID: CVE-2024-36336)
The vulnerability allows a local user to execute arbitrary code on the target system.
The vulnerability exists due to integer overflow within the AMD NPU Driver. A local user can pass specially crafted data to the application, trigger integer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Remediation
Install update from vendor's website.