Incorrect default permissions in AMD Software: PRO Edition
Priority LOW 36CWE-276Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
Incorrect default permissions in the AMD HIP SDK installation directory could allow an attacker to achieve privilege escalation potentially resulting in arbitrary code execution.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00261 17th percentileScored 2026-11-07
Fix Fixed AMD Software: PRO Edition (AMD): 24.10.16, 24.Q2 (24.10.20)AMD Software: Adrenalin Edition (AMD): 24.6.1 (24.10.21.01)+1 more product
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| AMD | AMD Software: PRO Edition | before 24.10.16; before 24.Q2 (24.10.20) | 24.10.16, 24.Q2 (24.10.20) | Patch available | CNA |
| AMD | AMD Software: Adrenalin Edition | before 24.6.1 (24.10.21.01) | 24.6.1 (24.10.21.01) | Patch available | CNA |
| AMD | AMD Software: Cloud Edition | before 24.7.1 | 24.7.1 | Patch available | CNA |
- AMD Software: PRO Edition VendorAMD Affected before 24.10.16; before 24.Q2 (24.10.20) Fixed in 24.10.16, 24.Q2 (24.10.20) Patch available CNA
- AMD Software: Adrenalin Edition VendorAMD Affected before 24.6.1 (24.10.21.01) Fixed in 24.6.1 (24.10.21.01) Patch available CNA
- AMD Software: Cloud Edition VendorAMD Affected before 24.7.1 Fixed in 24.7.1 Patch available CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:amd:radeon_software:*:*:*:*:adrenalin:*:*:* | before 24.6.1 | Vulnerable | AMD |
| cpe:2.3:a:amd:radeon_software:*:*:*:*:cloud:*:*:* | before 24.7.1 | Vulnerable | AMD |
| cpe:2.3:a:amd:radeon_software:*:*:*:*:pro:*:*:* | before 24.q2 | Vulnerable | AMD |
| cpe:2.3:a:amd:radeon_software_for_hip:*:*:*:*:pro:*:*:* | before 24.10.16 | Vulnerable | AMD |
- cpe:2.3:a:amd:radeon_software:*:*:*:*:adrenalin:*:*:* Versions before 24.6.1 Vulnerable ·AMD
- cpe:2.3:a:amd:radeon_software:*:*:*:*:cloud:*:*:* Versions before 24.7.1 Vulnerable ·AMD
- cpe:2.3:a:amd:radeon_software:*:*:*:*:pro:*:*:* Versions before 24.q2 Vulnerable ·AMD
- cpe:2.3:a:amd:radeon_software_for_hip:*:*:*:*:pro:*:*:* Versions before 24.10.16 Vulnerable ·AMD
Remediation
- Fix · CNA AMD Software: PRO Edition (AMD) Fixed in 24.10.16, 24.Q2 (24.10.20)
- Fix · CNA AMD Software: Adrenalin Edition (AMD) Fixed in 24.6.1 (24.10.21.01)
- Fix · CNA AMD Software: Cloud Edition (AMD) Fixed in 24.7.1
Timeline
- 2026-10-02 Threatist record created from CVE-2024-21937
- 2026-10-03 Alias added: GHSA-cmh5-78pc-x57w
References
More AMD Radeon Software vulnerabilities
- TI-2023-07046 Improper privilege management in AMD Radeon™ RX 5000 Series Graphics Cards CVSS 3.1HIGH 7.8
- TI-2023-07036 A potential vulnerability was reported in Radeon™ Software Crimson ReLive Edition which… CVSS 3.1CRITICAL 9.8
- TI-2021-08184 Improper access control in AMD Radeon RX 6000 Series & PRO W6000 Series CVSS 3.1HIGH 7.8
- TI-2023-14993 Improper input validation in AMD Radeon™ RX 5000/6000/7000 Series Graphics Cards CVSS 3.1HIGH 7.5
- TI-2021-08212 Improper signature verification in AMD Radeon RX 5000 Series & PRO W5000 Series CVSS 3.1HIGH 7.8
- TI-2021-08213 Out-of-bounds write in AMD Radeon RX 5000 Series & PRO W5000 Series CVSS 3.1HIGH 7.8
Sources
- CVE-2024-21937 · CVE Program
- CVE-2024-21937 · NVD
- FIRST EPSS
- GHSA-cmh5-78pc-x57w · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences