CVE-2023-20598 Privilege escalation in Ryzen™ 7020 Series Processors with Radeon™ Graphics

High 7.8 Published 17 Oct 2023 Updated 2 Aug 2024

An authenticated attacker can exploit improper privilege management in AMD Radeon drivers to gain I/O control and execute arbitrary code.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-20598?

CVE-2023-20598 is a high-severity vulnerability in Amd Radeon Software, published on 17 Oct 2023. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

An improper privilege management in the AMD Radeon™ Graphics driver may allow an authenticated attacker to craft an IOCTL request to gain I/O control over arbitrary hardware ports or physical addresses resulting in a potential arbitrary code execution.

Weakness: CWE-269

Which versions are affected by CVE-2023-20598?

It affects 1 product.

Products include Amd Radeon Software.

How do I fix CVE-2023-20598?

No fix has been published for CVE-2023-20598 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-20598 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-20598 exists.

Public exploit code: 1 proofs of concept on GitHub.

All Amd Radeon Software vulnerabilities

Sources

Also known as GHSA-cjgx-jx6j-cmg7.