Home » Database

AVID-2026-R1421

Description

Vulnerability CVE-2024-21975

Details

Improper input validation in the NPU driver could allow an attacker to supply a specially crafted pointer potentially leading to arbitrary code execution.

Reason for inclusion in AVID: CVE-2024-21975 describes a software vulnerability in AMD’s NPU driver within the Ryzen AI software stack, enabling local arbitrary code execution via specially crafted input. This affects components used to build/run AI workloads (AI acceleration driver) and thus pertains to AI systems and their software supply chain. It is a security vulnerability with actionable details and references.

References

Affected or Relevant Artifacts

  • Developer: AMD
  • Deployer: AMD
  • Artifact Details:
TypeName
SystemAMD Ryzen™ AI Software

Impact

AVID Taxonomy Categorization

  • Risk domains: Security
  • SEP subcategories: S0100: Software Vulnerability
  • Lifecycle stages: L06: Deployment

CVSS

Version3.1
Vector StringCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Base Score8.8
Base Severity🔴 High
Attack VectorLOCAL
Attack Complexity🟢 Low
Privileges Required🟢 Low
User InteractionNONE
ScopeCHANGED
Confidentiality Impact🔴 High
Integrity Impact🔴 High
Availability Impact🔴 High

CWE

IDDescription
CWE-20CWE-20 Improper Input Validation

Other information

  • Report Type: Advisory
  • Credits:
  • Date Reported: 2024-11-12
  • Version: 0.3.3
  • AVID Entry