Ce mail provient de l'extérieur, restons vigilants

=====================================================================

                            CERT-Renater

                Note d'Information No. 2025/VULN095

_____________________________________________________________________

DATE                : 14/02/2025

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running AMD Ryzen™ Master Utility
                         versions prior to 2.14.0.3205.

=====================================================================
https://www.amd.com/en/resources/product-security/bulletin/amd-sb-9010.html
_____________________________________________________________________


AMD Ryzen™ Master Utility DLL Hijacking Vulnerability

AMD ID:  AMD-SB-9010
Potential Impact: Arbitrary Code Execution
Severity: High
Summary

A researcher reported a DLL hijacking vulnerability within the AMD
Ryzen™ Master Utility.

AMD Ryzen™ Master Utility is a tool designed to unlock and customize
the performance of AMD Ryzen™ processors.  It can provide a
user-friendly interface for overclocking, monitoring system
performance, and adjusting various system settings such as power and
curve optimization.

The researcher reported a DLL hijacking vulnerability that could
allow an attacker to escalate privileges, resulting in arbitrary
code execution. AMD was able to reproduce the issue and believes
the reported vulnerability occurs because the AMD Ryzen™ Master
Utility does not include checks to prevent a dynamic load of
DLLs’.


CVE Details

Refer to Glossary for explanation of terms

CVE
	

CVSS Severity
	

CVE Description

CVE-2024-21966
	

7.3 (High)
AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
	
A DLL hijacking vulnerability in the AMD Ryzen™ Master Utility
could allow an attacker to achieve privilege escalation,
potentially resulting in arbitrary code execution.


Affected Products

AMD Ryzen™ Master Utility


Mitigation

AMD recommends updating to AMD Ryzen™ Master Utility software
version 2.14.0.3205 or higher.


Acknowledgement

AMD thanks Pwni for reporting these issues and engaging in
coordinated vulnerability disclosure. 


Revisions 

Revision Date      Description  

2025-02-11         Initial publication  

DISCLAIMER

The information contained herein is for informational purposes
only and is subject to change without notice. While every precaution
has been taken in the preparation of this document, it may contain
technical inaccuracies, omissions and typographical errors, and
AMD is under no obligation to update or otherwise correct this
information. Advanced Micro Devices, Inc. makes no representations
or warranties with respect to the accuracy or completeness of the
contents of this document, and assumes no liability of any kind,
including the implied warranties of noninfringement,
merchantability or fitness for particular purposes, with respect
to the operation or use of AMD hardware, software or other products
described herein. Any computer system has risks of security
vulnerabilities that cannot be completely prevented or mitigated.
No license, including implied or arising by estoppel, to any
intellectual property rights is granted by this document. Terms
and limitations applicable to the purchase or use of AMD’s
products are as set forth in a signed agreement between the
parties or in AMD's Standard Terms and Conditions of Sale.

AMD, the AMD Arrow logo, Ryzen, and combinations thereof are
trademarks of Advanced Micro Devices, Inc. CVE and the CVE logo
are registered trademarks of The MITRE Corporation. Other
product names used in this publication are for identification
purposes only and may be trademarks of their respective companies.

Third party content may be licensed to you directly by the third
party that owns the content and is not licensed to you by AMD.
ALL LINKED THIRD-PARTY CONTENT IS PROVIDED ‘AS IS’ WITHOUT A
WARRANTY OF ANY KIND. USE OF SUCH THIRD-PARTY CONTENT IS DONE
AT YOUR SOLE DISCRETION AND UNDER NO CIRCUMSTANCES WILL AMD BE
LIABLE TO YOU FOR ANY THIRD PARTY CONTENT. YOU ASSUME ALL RISK
AND ARE SOLELY RESPONSIBILITY FOR ANY DAMAGES THAT MAY ARISE
FROM YOUR USE OF THIRD-PARTY CONTENT.

© 2025 Advanced Micro Devices, Inc. All rights reserved.


=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================