Executive brief
A security flaw in AMD's video processing hardware could allow a malicious user or virtual machine to bypass security boundaries. This could lead to unauthorized access to data belonging to other users or virtual machines running on the same physical server. In practice, this means an attacker could potentially read or modify sensitive information they should not have access to, compromising the privacy and integrity of the system.
Technical details
The vulnerability is caused by improper isolation within the VCN-JPEG hardware register space on AMD processors. An attacker with local access and low privileges can exploit this lack of isolation to access the register space of JPEG cores assigned to other processes or guest virtual machines. This bypasses the intended hardware-level separation between different execution environments. Successful exploitation grants the attacker arbitrary read and write access to the memory and data of the victim process or VM. The issue is tracked as AMD-SB-6027 and has been assigned a CVSS 4.0 score of 8.8.
Affected products
- AMD VCN-JPEG HW Register Space
Timeline
- 2026-05-15: advisory: AMD published security bulletin AMD-SB-6027 and CVE-2024-36323 was released.