Time-of-check time-of-use race condition in AMD Radeon™ RX 5000 Series Graphics Products
Priority LOW 30CWE-367Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- Low · High · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
A Time-of-check time-of-use (TOCTOU) race condition in the AMD Secure Processor (ASP) could allow an attacker to corrupt memory resulting in loss of integrity, confidentiality, or availability.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00109 1st percentileScored 2026-11-07
Fix Fixed AMD Radeon™ RX 5000 Series Graphics Products (AMD): AMD Software: Adrenalin Edition 25.6.1 (25.10.13.01), AMD Software: PRO Edition 25.Q2 (25.10.10)AMD Radeon™ PRO W5000 Series Graphics Products (AMD): AMD Software: Adrenalin Edition 25.6.1 (25.10.13.01), AMD Software: PRO Edition 25.Q2 (25.10.10)+6 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| AMD | AMD Radeon™ RX 5000 Series Graphics Products | — | AMD Software: Adrenalin Edition 25.6.1 (25.10.13.01), AMD Software: PRO Edition 25.Q2 (25.10.10) | Patch available | CNA |
| AMD | AMD Radeon™ PRO W5000 Series Graphics Products | — | AMD Software: Adrenalin Edition 25.6.1 (25.10.13.01), AMD Software: PRO Edition 25.Q2 (25.10.10) | Patch available | CNA |
| AMD | AMD Radeon™ VII | — | No fix planned | Patch available | CNA |
| AMD | AMD Radeon™ PRO VII | — | No fix planned | Patch available | CNA |
| AMD | AMD Instinct™ MI210 | — | ROCm 6.2 | Patch available | CNA |
| AMD | AMD Instinct™ MI250 | — | ROCm 6.2 | Patch available | CNA |
| AMD | AMD Instinct™ MI300X | — | ROCm 6.2 | Patch available | CNA |
| AMD | AMD Instinct™ MI300A | — | ROCm 6.2 | Patch available | CNA |
- AMD Radeon™ RX 5000 Series Graphics Products VendorAMD Affected — Fixed in AMD Software: Adrenalin Edition 25.6.1 (25.10.13.01), AMD Software: PRO Edition 25.Q2 (25.10.10) Patch available CNA
- AMD Radeon™ PRO W5000 Series Graphics Products VendorAMD Affected — Fixed in AMD Software: Adrenalin Edition 25.6.1 (25.10.13.01), AMD Software: PRO Edition 25.Q2 (25.10.10) Patch available CNA
- AMD Radeon™ VII VendorAMD Affected — Fixed in No fix planned Patch available CNA
- AMD Radeon™ PRO VII VendorAMD Affected — Fixed in No fix planned Patch available CNA
- AMD Instinct™ MI210 VendorAMD Affected — Fixed in ROCm 6.2 Patch available CNA
- AMD Instinct™ MI250 VendorAMD Affected — Fixed in ROCm 6.2 Patch available CNA
- AMD Instinct™ MI300X VendorAMD Affected — Fixed in ROCm 6.2 Patch available CNA
- AMD Instinct™ MI300A VendorAMD Affected — Fixed in ROCm 6.2 Patch available CNA
CPE configurations NVD · 27
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:amd:rocm:*:*:*:*:*:*:*:* | before 6.2.0 | Vulnerable | AMD |
| cpe:2.3:h:amd:instinct_mi210:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:h:amd:instinct_mi250:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:h:amd:instinct_mi300a:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:h:amd:instinct_mi300x:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:a:amd:radeon_software:*:*:*:*:pro:*:*:* | before 25.q2 | Vulnerable | AMD |
| cpe:2.3:h:amd:radeon_pro_w5500:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:h:amd:radeon_pro_w5500x:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:h:amd:radeon_pro_w5700:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:h:amd:radeon_pro_w5700x:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
- cpe:2.3:a:amd:rocm:*:*:*:*:*:*:*:* Versions before 6.2.0 Vulnerable ·AMD
- cpe:2.3:h:amd:instinct_mi210:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:h:amd:instinct_mi250:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:h:amd:instinct_mi300a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:h:amd:instinct_mi300x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:a:amd:radeon_software:*:*:*:*:pro:*:*:* Versions before 25.q2 Vulnerable ·AMD
- cpe:2.3:h:amd:radeon_pro_w5500:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:h:amd:radeon_pro_w5500x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:h:amd:radeon_pro_w5700:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:h:amd:radeon_pro_w5700x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
Show 17 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:amd:radeon_software:*:*:*:*:adrenalin:*:*:* | before 24.6.1 | Vulnerable | AMD |
| cpe:2.3:h:amd:radeon_rx_5300:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:h:amd:radeon_rx_5300_xt:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:h:amd:radeon_rx_5300m:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:h:amd:radeon_rx_5500:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:h:amd:radeon_rx_5500_xt:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:h:amd:radeon_rx_5500m:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:h:amd:radeon_rx_5600:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:h:amd:radeon_rx_5600_xt:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:h:amd:radeon_rx_5600m:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:h:amd:radeon_rx_5700:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:h:amd:radeon_rx_5700_xt:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:h:amd:radeon_rx_5700m:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:radeon_vii_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | AMD |
| cpe:2.3:h:amd:radeon_vii:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:radeon_pro_vii_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | AMD |
| cpe:2.3:h:amd:radeon_pro_vii:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
- cpe:2.3:a:amd:radeon_software:*:*:*:*:adrenalin:*:*:* Versions before 24.6.1 Vulnerable ·AMD
- cpe:2.3:h:amd:radeon_rx_5300:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:h:amd:radeon_rx_5300_xt:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:h:amd:radeon_rx_5300m:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:h:amd:radeon_rx_5500:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:h:amd:radeon_rx_5500_xt:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:h:amd:radeon_rx_5500m:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:h:amd:radeon_rx_5600:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:h:amd:radeon_rx_5600_xt:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:h:amd:radeon_rx_5600m:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:h:amd:radeon_rx_5700:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:h:amd:radeon_rx_5700_xt:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:h:amd:radeon_rx_5700m:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:radeon_vii_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·AMD
- cpe:2.3:h:amd:radeon_vii:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:radeon_pro_vii_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·AMD
- cpe:2.3:h:amd:radeon_pro_vii:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
Remediation
- Fix · CNA AMD Radeon™ RX 5000 Series Graphics Products (AMD) Fixed in AMD Software: Adrenalin Edition 25.6.1 (25.10.13.01), AMD Software: PRO Edition 25.Q2 (25.10.10)
- Fix · CNA AMD Radeon™ PRO W5000 Series Graphics Products (AMD) Fixed in AMD Software: Adrenalin Edition 25.6.1 (25.10.13.01), AMD Software: PRO Edition 25.Q2 (25.10.10)
- Fix · CNA AMD Radeon™ VII (AMD) Fixed in No fix planned
- Fix · CNA AMD Radeon™ PRO VII (AMD) Fixed in No fix planned
- Fix · CNA AMD Instinct™ MI210 (AMD) Fixed in ROCm 6.2
- Fix · CNA AMD Instinct™ MI250 (AMD) Fixed in ROCm 6.2
- Fix · CNA AMD Instinct™ MI300X (AMD) Fixed in ROCm 6.2
- Fix · CNA AMD Instinct™ MI300A (AMD) Fixed in ROCm 6.2
Timeline
- 2026-10-02 Threatist record created from CVE-2023-20548
- 2026-10-03 Alias added: GHSA-pc33-gmp7-wv52
References
More AMD Radeon Pro Vii Firmware vulnerabilities
- TI-2023-14996 Time-of-check time-of-use race condition in AMD Radeon™ RX 5000 Series Graphics Products CVSS 4.0HIGH 7.1
Sources
- CVE-2023-20548 · CVE Program
- CVE-2023-20548 · NVD
- FIRST EPSS
- GHSA-pc33-gmp7-wv52 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences