Home » Database

AVID-2026-R1418

Description

Vulnerability CVE-2024-21949

Details

Improper validation of user input in the NPU driver could allow an attacker to provide a buffer with unexpected size, potentially leading to system crash.

Reason for inclusion in AVID: CVE-2024-21949 describes improper input validation in the AMD NPU driver (part of AMD Ryzen AI Software). This is a software component used to accelerate AI workloads and run AI systems, i.e., a component in the AI software stack. The issue is a vulnerability (potential crash) in a driver, affecting availability, and relates to software supply chain components (drivers, AI acceleration stack). The report provides CVSS details and references, giving sufficient signal for classification.

References

Affected or Relevant Artifacts

  • Developer: AMD
  • Deployer: AMD
  • Artifact Details:
TypeName
SystemAMD Ryzen™ AI Software

Impact

AVID Taxonomy Categorization

  • Risk domains: Security
  • SEP subcategories: S0100: Software Vulnerability
  • Lifecycle stages: L06: Deployment

CVSS

Version3.1
Vector StringCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Base Score5.5
Base Severity🟠 Medium
Attack VectorLOCAL
Attack Complexity🟢 Low
Privileges Required🟢 Low
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactNONE
Integrity ImpactNONE
Availability Impact🔴 High

CWE

IDDescription
CWE-20CWE-20 Improper Input Validation

Other information

  • Report Type: Advisory
  • Credits:
  • Date Reported: 2024-11-12
  • Version: 0.3.3
  • AVID Entry