AMD disclosed The Popular Ryzen Master Software Utility That Enables CPU Monitoring And Overclocking Capabilities In The Consumer Processor Lineup Has A New Rank 7.2 (High) Vulnerability, Could Allow An Attacker To Take Full Control Of The System There is a nature. AMD posted a new updated version of his Ryzen Master for Windows 10 and Windows 11 that fixes the issue.
AMD said the issue was caused by not validating the user’s privilege level during the Ryzen master installation process, stating that “a low-privileged attacker could modify files that could result in elevated privileges or an It can lead to code execution.”
This means that a user with a low privilege level on a computer can use an older version of Ryzen Master to gain administrator access and finally change critical system files and take full control of the system. However, it remains unknown whether users without administrator access can use older installations of her utility to facilitate attacks.
AMD Ryzen Master also offers several features that allow fine-grained control of your system, such as real-time access to changing voltages and clock rates. If a low-level user has access to these capabilities, it’s unclear if they can be used for timing attacks on clocks and voltages in the same way as Hertzbleed and Plundervolt. I am following up with AMD for further clarification.
AMD has patched a previous Ryzen Master issue spotted by HP in 2020 (opens in new tab)which also allowed privilege escalation (CVE-2020-12928). The company recently patched an error that allowed graphics card drivers to automatically overclock the CPU without permission, revealing 31 newly discovered vulnerabilities last month.
AMD has at least Version 2.10.1.2287 Keep your software up to date and patch vulnerabilities. The new version has some notable improvements over the existing version, including adding support for setting a maximum operating temperature that slows down the processor if it exceeds the allotted temperature. Ryzen Master now also allows assigning voltages higher than 5.2V. This is well above normal operating voltages (don’t do this if you don’t know what you’re doing). Naturally, most users won’t need that feature on their existing chips, but it’s useful for extreme overclockers and could come in handy in future models. Not supported.
New vulnerabilities include CVE-2022-27677 identifier, released in a coordinated vulnerability disclosure with Conor McNamara.
