CVE-2020-12930: AMD Enterprise Driver Privilege Escalation

CVE-2020-12930 Overview

CVE-2020-12930 is a privilege escalation vulnerability affecting AMD Secure Processor (ASP) drivers across a wide range of AMD products. The vulnerability stems from improper parameters handling within the ASP drivers, which may allow a privileged attacker to elevate their privileges beyond their authorized level, potentially leading to loss of system integrity.

The AMD Secure Processor, also known as Platform Security Processor (PSP), is a dedicated security subsystem integrated into AMD CPUs that handles sensitive security operations including secure boot, trusted execution, and cryptographic functions. A compromise of this component can have severe implications for the overall security posture of affected systems.

Critical Impact

A privileged attacker can exploit improper parameter handling in AMD Secure Processor drivers to escalate privileges, potentially compromising system integrity and gaining unauthorized control over security-critical processor functions.

Affected Products

• AMD Enterprise Driver (versions prior to 22.10.20)
• AMD Radeon Pro Software (Enterprise editions prior to 22.Q3)
• AMD Radeon Software (versions prior to 22.5.2)
• AMD Radeon RX 5000 Series (RX 5300, RX 5500, RX 5600, RX 5700 variants)
• AMD Radeon RX Vega 56/64 (including firmware)
• AMD Radeon Pro W5500/W5500X/W5700/W5700X
• AMD Ryzen 3000/5000 Series Desktop Processors
• AMD Ryzen 2000/3000/5000 Series Mobile Processors
• AMD Ryzen Threadripper 3000/Pro Series
• AMD Athlon 3000 Series Mobile Processors

Discovery Timeline

• November 9, 2022 - CVE-2020-12930 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2020-12930

Vulnerability Analysis

This vulnerability exists within the AMD Secure Processor (ASP) driver components responsible for handling communications between the operating system and the dedicated security processor. The ASP is a hardware-isolated ARM Cortex-A5 processor embedded within AMD CPUs that manages security-sensitive operations including secure boot validation, firmware trusted platform module (fTPM) functions, and memory encryption.

The improper parameter handling occurs when the driver processes requests from privileged user-mode or kernel-mode components. When malformed or unexpected parameters are passed to the ASP driver, the lack of proper validation creates an opportunity for an attacker with existing privileges to manipulate the driver's behavior and escalate to higher privilege levels.

The vulnerability requires local access and an attacker must already possess some level of privilege on the target system. However, successful exploitation can lead to complete compromise of system integrity by allowing the attacker to execute code with elevated privileges or manipulate security-critical functions handled by the ASP.

Root Cause

The root cause of CVE-2020-12930 is insufficient input validation and improper parameter handling within the AMD Secure Processor driver code. When parameters are passed to the driver through IOCTL calls or other driver interfaces, the code fails to adequately verify the validity, bounds, and format of these parameters before processing them. This creates a condition where carefully crafted malicious parameters can cause the driver to perform unintended operations, leading to privilege escalation.

Attack Vector

The attack vector for this vulnerability is local, requiring the attacker to have authenticated access to the target system with at least limited privileges. The exploitation path typically involves:

1. An attacker with local access to a system running vulnerable AMD drivers identifies the ASP driver interface
2. The attacker crafts specially formatted parameters designed to exploit the improper handling vulnerability
3. These malicious parameters are passed to the driver through standard system interfaces
4. The driver processes the parameters without adequate validation, resulting in unintended behavior
5. The attacker leverages this behavior to escalate privileges beyond their authorized level

Since no user interaction is required beyond the initial system access, and the attack complexity is relatively low, this vulnerability presents a meaningful risk for systems where untrusted users have local access.

Detection Methods for CVE-2020-12930

Indicators of Compromise

• Unusual IOCTL calls or driver interactions targeting AMD Secure Processor drivers (amdpsp.sys, amdacppsvc.exe)
• Unexpected privilege elevation events associated with AMD driver processes
• Anomalous memory access patterns or operations involving the PSP address space
• Driver crash events or unexpected driver behavior in AMD ASP components

Detection Strategies

• Monitor system event logs for privilege escalation attempts or unexpected elevation of process privileges
• Implement endpoint detection rules to identify suspicious interactions with AMD driver components
• Deploy file integrity monitoring on AMD driver files to detect unauthorized modifications
• Use behavior-based detection to identify unusual sequences of system calls associated with driver exploitation

Monitoring Recommendations

• Enable verbose logging for driver operations where supported by system security tools
• Configure SentinelOne to monitor for suspicious driver loading and IOCTL operations
• Establish baseline behavior for AMD driver processes and alert on deviations
• Monitor for attempts to access or modify AMD Secure Processor-related registry keys and configuration

How to Mitigate CVE-2020-12930

Immediate Actions Required

• Update AMD Radeon Software to version 22.5.2 or later immediately
• Update AMD Radeon Pro Software (Enterprise) to version 22.Q3 or later
• Update AMD Enterprise Driver to version 22.10.20 or later
• Apply BIOS/UEFI firmware updates from system OEMs that include updated AMD microcode
• Audit systems for vulnerable driver versions using driver inventory tools

Patch Information

AMD has released security updates addressing this vulnerability as documented in AMD Security Bulletin SB-1029. The following minimum driver versions contain the fix:

• AMD Radeon Software: Version 22.5.2 or later
• AMD Radeon Pro Software (Enterprise): Version 22.Q3 or later
• AMD Enterprise Driver: Version 22.10.20 or later

Additionally, processor firmware updates are available through system OEM BIOS updates. Users should check with their system manufacturer for the latest BIOS updates that include AMD security patches. Refer to AMD Security Bulletin SB-5001 for additional security update information.

Workarounds

• Restrict local access to systems with vulnerable drivers to only trusted administrators
• Implement application allowlisting to prevent unauthorized code execution that could attempt exploitation
• Enable enhanced monitoring on systems that cannot be immediately patched
• Consider network segmentation to limit the impact if a local privilege escalation occurs

# Verify current AMD driver version on Windows
wmic path win32_videocontroller get driverversion,name | findstr /i AMD

# Check AMD GPU driver version via PowerShell
Get-WmiObject Win32_VideoController | Where-Object { $_.Name -like "*AMD*" } | Select-Object Name, DriverVersion