Read the docs
TI-2023-15009 Aliases CVE-2023-31349GHSA-pwh8-gr2w-8xpq

Incorrect default permissions in AMD μProf Tool

Priority LOW 35CWE-276Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Incorrect default permissions in the AMD μProf installation directory could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00157 4th percentileScored 2026-11-07
Fix Fixed μProf Tool (AMD): 3.4.494

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AMDμProf ToolμProf Tool to before 3.4.4943.4.494Patch availableCNA
  • μProf Tool VendorAMD Affected μProf Tool to before 3.4.494 Fixed in 3.4.494 Patch available CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:amd:uprof:*:*:*:*:*:linux:*:*before 4.1.424VulnerableAMD
cpe:2.3:a:amd:uprof:*:*:*:*:*:freebsd:*:*before 4.2.816VulnerableAMD
cpe:2.3:a:amd:uprof:*:*:*:*:*:windows:*:*before 4.2.845VulnerableAMD
  • cpe:2.3:a:amd:uprof:*:*:*:*:*:linux:*:* Versions before 4.1.424 Vulnerable ·AMD
  • cpe:2.3:a:amd:uprof:*:*:*:*:*:freebsd:*:* Versions before 4.2.816 Vulnerable ·AMD
  • cpe:2.3:a:amd:uprof:*:*:*:*:*:windows:*:* Versions before 4.2.845 Vulnerable ·AMD

Remediation

  • Fix · CNA μProf Tool (AMD) Fixed in 3.4.494

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    AMD μProf Tool 3.4.494

    4 records Highest priority Priority LOW 4 LOW

    Other records, highest priority first

    • TI-2023-15008 Uncontrolled resource consumption in AMD μProf ToolPriority LOW 35
    • TI-2023-15002 Improper access control in AMD μProf ToolPriority LOW 33
    • TI-2023-15020 Improper input validation in AMD μProf ToolPriority LOW 24
    Show all 4 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-31349
  2. 2026-10-03 Alias added: GHSA-pwh8-gr2w-8xpq

References

Advisory 1

  • TI-2023-15008 Uncontrolled resource consumption in AMD μProf Tool CVSS 3.1HIGH 7.8
  • TI-2023-15002 Improper access control in AMD μProf Tool CVSS 3.1HIGH 7.3
  • TI-2025-30788 Improper return value within AMD uProf can allow a local attacker to bypass KSLR… CVSS 3.1HIGH 7.1
  • TI-2024-24136 A junction point vulnerability within AMD uProf can allow a local low-privileged attacker… CVSS 3.1MEDIUM 6.6
  • TI-2026-22567 Resource allocation without limits in AMD µProf CVSS 4.0MEDIUM 6.8
  • TI-2026-00289 Improper access control in AMD uProf may allow a local attacker with user privileges to… CVSS 4.0MEDIUM 6.8
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences