What’s Vulnerable › Vulnerabilities

CVE-2023-31324

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-02-11 · updated 2026-06-17
• Weakness: CWE-367

Description

A Time-of-check time-of-use (TOCTOU) race condition in the AMD Secure Processor (ASP) could allow an attacker to modify External Global Memory Interconnect Trusted Agent (XGMI TA) commands as they are processed potentially resulting in loss of confidentiality, integrity, or availability.

Affected products

• AMD Radeon Pro Vii Firmware: all versions
• AMD Radeon Software: before 25.q2; before 24.6.1 — fixed in 24.6.1, 25.q2
• AMD Radeon Vii Firmware: all versions
• AMD Rocm: before 6.2.0 — fixed in 6.2.0

How to fix

Upgrade to a fixed version: AMD Radeon Software 24.6.1, 25.q2; AMD Rocm 6.2.0. Check the vendor advisory for mitigations.

References

• https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-6024.html

Get alerted when CVE-2023-31324 or the next vulnerability affects your stack