Improper verification of communication channel in AMD Versal Adaptive SoC Devices
Priority LOW 15CWE-497Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Information disclosure, Denial of service
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-497 and CWE-772.
Summary
In AMD Versal Adaptive SoC devices, the incorrect configuration of the SSS during runtime (post-boot) cryptographic operations could cause data to be incorrectly written to and read from invalid locations as well as returning incorrect cryptographic data.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00152 4th percentileScored 2026-11-08
Fix Fixed Versal Adaptive SoC Devices (AMD): 2025.1 releaseVersal RF Series (AMD): 2025.1 release+6 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| AMD | Versal Adaptive SoC Devices | — | 2025.1 release | Patch available | CNA |
| AMD | Versal RF Series | — | 2025.1 release | Patch available | CNA |
| AMD | Versal AI Edge Series | — | 2025.1 release | Patch available | CNA |
| AMD | Versal Prime Series | — | 2025.1 release | Patch available | CNA |
| AMD | Versal Premium Series | — | 2025.1 release | Patch available | CNA |
| AMD | Versal AI Core Series | — | 2025.1 release | Patch available | CNA |
| AMD | Versal HBM Series | — | 2025.1 release | Patch available | CNA |
| AMD | Alveo V80 Compute Accelerator | — | 2025.1 release | Patch available | CNA |
- Versal Adaptive SoC Devices VendorAMD Affected — Fixed in 2025.1 release Patch available CNA
- Versal RF Series VendorAMD Affected — Fixed in 2025.1 release Patch available CNA
- Versal AI Edge Series VendorAMD Affected — Fixed in 2025.1 release Patch available CNA
- Versal Prime Series VendorAMD Affected — Fixed in 2025.1 release Patch available CNA
- Versal Premium Series VendorAMD Affected — Fixed in 2025.1 release Patch available CNA
- Versal AI Core Series VendorAMD Affected — Fixed in 2025.1 release Patch available CNA
- Versal HBM Series VendorAMD Affected — Fixed in 2025.1 release Patch available CNA
- Alveo V80 Compute Accelerator VendorAMD Affected — Fixed in 2025.1 release Patch available CNA
Remediation
- Fix · CNA Versal Adaptive SoC Devices (AMD) Fixed in 2025.1 release
- Fix · CNA Versal RF Series (AMD) Fixed in 2025.1 release
- Fix · CNA Versal AI Edge Series (AMD) Fixed in 2025.1 release
- Fix · CNA Versal Prime Series (AMD) Fixed in 2025.1 release
- Fix · CNA Versal Premium Series (AMD) Fixed in 2025.1 release
- Fix · CNA Versal AI Core Series (AMD) Fixed in 2025.1 release
- Fix · CNA Versal HBM Series (AMD) Fixed in 2025.1 release
- Fix · CNA Alveo V80 Compute Accelerator (AMD) Fixed in 2025.1 release
Timeline
- 2026-10-02 Threatist record created from CVE-2025-0036
- 2026-10-03 Alias added: GHSA-55hh-327m-68hj
More AMD vulnerabilities
- TI-2026-36341 AI Tensor Engine for ROCm (AITER) 0.1.14 Unauthenticated RCE via MessageQueue.recv() Pickle Deserialization CVSS 4.0CRITICAL 9.2
- TI-2023-07046 Improper privilege management in AMD Radeon™ RX 5000 Series Graphics Cards CVSS 3.1HIGH 7.8
- TI-2023-04574 GPU kernel implementations susceptible to memory leak CVSS 3.1MEDIUM 6.5
- TI-2023-07042 Information disclosure through error messages in AMD Ryzen™ 3000 Series Desktop… CVSS 3.1MEDIUM 5.5
- TI-2023-23747 PVRIC (PowerVR Image Compression) on Imagination 2018 and later GPU devices offers… CVSS 3.1MEDIUM 5.3
- TI-2022-07839 Improper access control in System Management Mode (SMM) may allow an attacker to write to… CVSS 3.1CRITICAL 9.8
Sources
- CVE-2025-0036 · CVE Program
- CVE-2025-0036 · NVD
- FIRST EPSS
- GHSA-55hh-327m-68hj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences