CVE-2023-20562

HIGH

AMD uProf < 4.1.396 - Authenticated Arbitrary Kernel Execution via IOCTL Input Buffer

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2023-20562. PoCs published by zeze-zeze, passwa11.

AI-analyzed exploit summary This repository contains a functional exploit for CVE-2023-20562, targeting AMD μProf's AMDCpuProfiler.sys driver to achieve privilege escalation to SYSTEM via arbitrary write on the EPROCESS token. It also includes a BYOVD (Bring Your Own Vulnerable Driver) component to disable DSE and bypass 360 Total Security protections.

Description

Insufficient validation in the IOCTL (Input Output Control) input buffer in AMD uProf may allow an authenticated user to load an unsigned driver potentially leading to arbitrary kernel execution.

Exploits (2)

nomisec WORKING POC 61 stars
by zeze-zeze · poc
https://github.com/zeze-zeze/HITCON-2023-Demo-CVE-2023-20562

This repository contains a functional exploit for CVE-2023-20562, targeting AMD μProf's AMDCpuProfiler.sys driver to achieve privilege escalation to SYSTEM via arbitrary write on the EPROCESS token. It also includes a BYOVD (Bring Your Own Vulnerable Driver) component to disable DSE and bypass 360 Total Security protections.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Complex
Reliability
Reliable
Target: AMD μProf 3.6.839 and 360 Total Security 6.6.0.1060
Auth required
Prerequisites: Windows 10 1909 · AMD μProf 3.6.839 installed · 360 Total Security 6.6.0.1060 installed · Normal user privileges
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 4 stars
by passwa11 · poc
https://github.com/passwa11/HITCON-2023-Demo-CVE-2023-20562

This repository contains a functional exploit for CVE-2023-20562, targeting AMD μProf's AMDCpuProfiler.sys driver to achieve privilege escalation to SYSTEM via arbitrary write on the EPROCESS token. It also includes a BYOVD (Bring Your Own Vulnerable Driver) component to disable DSE and bypass 360 Total Security protections.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Complex
Reliability
Reliable
Target: AMD μProf 3.6.839 and 360 Total Security 6.6.0.1060
Auth required
Prerequisites: Windows 10 1909 · AMD μProf 3.6.839 installed · 360 Total Security 6.6.0.1060 installed · Normal user access
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (1)

Core 1
Core References

Scores

CVSS v3 7.8
EPSS 0.0115
EPSS Percentile 62.7%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

Status published
Products (1)
amd/amd_uprof < 4.1.396
Published Aug 08, 2023
Tracked Since Feb 18, 2026