AMD Instinct MI210 Global Variable amdgv_cmd toctou

Summaryinfo

A vulnerability classified as problematic has been found in AMD Radeon PRO V620, Radeon PRO V710, Instinct MI250, Instinct MI308X, Instinct MI300A, Instinct MI300X, Instinct MI325X and Instinct MI210. This vulnerability affects unknown code of the component Global Variable Handler. Performing a manipulation of the argument amdgv_cmd results in toctou. This vulnerability is known as CVE-2025-52532. Attacking locally is a requirement. No exploit is available.

Detailsinfo

A vulnerability, which was classified as problematic, was found in AMD Radeon PRO V620, Radeon PRO V710, Instinct MI250, Instinct MI308X, Instinct MI300A, Instinct MI300X, Instinct MI325X and Instinct MI210. This affects some unknown processing of the component Global Variable Handler. The manipulation of the argument amdgv_cmd with an unknown input leads to a toctou vulnerability. CWE is classifying the issue as CWE-367. The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state. This is going to have an impact on availability. The summary by CVE is:

A race condition in the MxGPU-Virtualization driver’s ioctl path caused by concurrent unsynchronized access to the global variable amdgv_cmd in an unlocked ioctl handler could be exploited by an attacker to trigger a heap-based buffer overflow, potentially resulting in denial-of-service within the vulnerable system context.

The advisory is shared at amd.com. This vulnerability is uniquely identified as CVE-2025-52532 since 06/17/2025. The exploitability is told to be difficult. An attack has to be approached locally. Technical details are known, but no exploit is available.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• AMD

Name

• Instinct MI210
• Instinct MI250
• Instinct MI300A
• Instinct MI300X
• Instinct MI308X
• Instinct MI325X
• Radeon PRO V620
• Radeon PRO V710

License

• commercial

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion