7 CVE-2025-54518
Improper isolation of shared resources within the CPU operation cache on Zen 2-based products could allow an attacker to corrupt instructions executed at a different privilege level, potentially resulting in privilege escalation.
https://nvd.nist.gov/vuln/detail/CVE-2025-54518
Categories
CWE-1189 : Improper Isolation of Shared Resources on System-on-a-Chip (SoC)
The System-On-a-Chip (SoC) does not properly isolate shared resources between trusted and untrusted agents. Processor has improper isolation of shared resources allowing for information disclosure. Baseboard Management Controller (BMC) device implements Advanced High-performance Bus (AHB) bridges that do not require authentication for arbitrary read and write access to the BMC's physical address space from the host, and possibly the network [REF-1138].
CWE-1220 : Insufficient Granularity of Access Control
The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets. A form hosting website only checks the session authentication status for a single form, making it possible to bypass authentication when there are multiple forms An operating system has an overly permission Access Control List onsome system files, including those related to user passwords
References
0b0ca135-0b70-47e7-9f44-1890c2a1c46c
af854a3a-2127-422b-91ae-364da2661108
psirt@amd.com
AFFECTED (from MITRE)
| Vendor |
Product |
Versions |
| AMD |
AMD EPYC⢠7002 Series Processors |
|
| AMD |
AMD Ryzen⢠4000 Series Mobile Processors with Radeon⢠Graphics |
- RenoirPI-FP6_1.0.0.Ed [unaffected]
|
| AMD |
AMD Ryzen⢠7020 Series Processors with Radeon⢠Graphics |
- MendocinoPI-FT6_1.0.0.7f [unaffected]
|
| AMD |
AMD Ryzen⢠3000 Series Desktop Processors |
- ComboAM4v2 1.2.0.10 [unaffected]
|
| AMD |
AMD Ryzen⢠Threadripper⢠PRO 3000 WX-Series Processors |
- ChagallWSPI-sWRX8-1.0.0.D [unaffected]
|
| AMD |
AMD Ryzen⢠7030 Series Mobile Processors with Radeon⢠Graphics |
- CezannePI-FP6_1.0.1.1d [unaffected]
|
| AMD |
AMD Ryzen⢠Threadripper⢠PRO 3000 WX-Series Processors |
- CastlePeakWSPI-sWRX8 1.0.0.I [unaffected]
|
| AMD |
AMD Ryzen⢠5000 Series Mobile Processors with Radeon⢠Graphics |
- CezannePI-FP6_1.0.1.1d [unaffected]
|
| AMD |
AMD Ryzen⢠5000 Series Mobile Processors with Radeon⢠Graphics |
- CezannePI-FP6_1.0.1.1d [unaffected]
|
| AMD |
AMD Ryzen⢠4000 Series Desktop Processors |
- ComboAM4v2 1.2.0.10 [unaffected]
|
| AMD |
AMD Ryzen⢠5000 Series Desktop Processors with Radeon⢠Graphics |
- ComboAM4v2 1.2.0.10 [unaffected]
|
| AMD |
AMD Ryzen⢠3000 Series Desktop Processors |
- ComboAM4PI 1.0.0.10 [unaffected]
|
| AMD |
AMD EPYC⢠Embedded 7002 Series Processors |
|
| AMD |
AMD Ryzen Embedded V2000A Series Processors |
- EmbeddedV2KAPI-FP6 1.0.0.A [unaffected]
|
| AMD |
AMD Ryzen⢠Embedded V2000 Series Processors |
- EmbeddedPI-FP6_1.0.0.D [unaffected]
|
| © 2022 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. |
CPE
REMEDIATION
EXPLOITS
Exploit-db.com
| id |
description |
date |
|
| No known exploits |
POC Github
Other Nist (github, ...)
CAPEC
Common Attack Pattern Enumerations and Classifications
| id |
description |
severity |
| 124 |
Shared Resource Manipulation
An adversary exploits a resource shared between multiple applications, an application pool or hardware pin multiplexing to affect behavior. Resources may be shared between multiple applications or between multiple threads of a single application. Resource sharing is usually accomplished through mutual access to a single memory location or multiplexed hardware pins. If an adversary can manipulate this shared resource (usually by co-opting one of the applications or threads) the other applications or threads using the shared resource will often continue to trust the validity of the compromised shared resource and use it in their calculations. This can result in invalid trust assumptions, corruption of additional data through the normal operations of the other users of the shared resource, or even cause a crash or compromise of the sharing applications. |
Medium |
| 1 |
Accessing Functionality Not Properly Constrained by ACLs
In applications, particularly web applications, access to functionality is mitigated by an authorization framework. This framework maps Access Control Lists (ACLs) to elements of the application's functionality; particularly URL's for web apps. In the case that the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker can access resources that must be available only to users at a higher privilege level, can access management sections of the application, or can run queries for data that they otherwise not supposed to. [Survey] The attacker surveys the target application, possibly as a valid and authenticated user [Identify Functionality] At each step, the attacker notes the resource or functionality access mechanism invoked upon performing specific actions [Iterate over access capabilities] Possibly as a valid user, the attacker then tries to access each of the noted access mechanisms directly in order to perform functions not constrained by the ACLs. |
High |
| 180 |
Exploiting Incorrectly Configured Access Control Security Levels
An attacker exploits a weakness in the configuration of access controls and is able to bypass the intended protection that these measures guard against and thereby obtain unauthorized access to the system or network. Sensitive functionality should always be protected with access controls. However configuring all but the most trivial access control systems can be very complicated and there are many opportunities for mistakes. If an attacker can learn of incorrectly configured access security settings, they may be able to exploit this in an attack. [Survey] The attacker surveys the target application, possibly as a valid and authenticated user. [Identify weak points in access control configurations] The attacker probes the access control for functions and data identified in the Explore phase to identify potential weaknesses in how the access controls are configured. [Access the function or data bypassing the access control] The attacker executes the function or accesses the data identified in the Explore phase bypassing the access control. |
Medium |
MITRE
Techniques
| id |
description |
| T1574.010 |
Hijack Execution Flow: ServicesFile Permissions Weakness |
| © 2022 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. |
Mitigations
| id |
description |
| M1018 |
Limit privileges of user accounts and groups so that only authorized administrators can interact with service changes and service binary target path locations. Deny execution from user directories such as file download directories and temp directories where able. |
| © 2022 The MITRE Corporation. Esta obra se reproduce y distribuye con el permiso de The MITRE Corporation. |
Cybersecurity needs ?
Strengthen software security from the outset with our DevSecOps expertise
Integrate security right from the start of the software development cycle for more robust applications and greater customer confidence.
Our team of DevSecOps experts can help you secure your APIs, data pipelines, CI/CD chains, Docker containers and Kubernetes deployments.
Discover this offer
