CVE-2025-48508
Raw vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:HSummary
CVE-2025-48508 is a medium-severity Improper Finite State Machines (FSMs) in Hardware Logic (CWE-1245) vulnerability in Amd (inferred from references). Its CVSS base score is 6.0 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SC-24 (Fail in Known State) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-207411
Vulnerability Data
Improper Hardware reset flow logic in the GPU GFX Hardware IP block could allow a privileged attacker in a guest virtual machine to control reset operation potentially causing host or GPU crash or reset resulting in denial of service.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation at post-design stages can discover undefined or insecure FSM states through simulation and formal verification.
Forcing a transition to a known safe state on failure limits the impact of an attacker-driven undefined FSM state.
Requiring the developer to produce a security architecture and design description forces explicit FSM modeling and review before implementation.
Security engineering principles applied during hardware design directly reduce the chance of introducing faulty FSM transitions or unreachable states.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure development practices and verification throughout the lifecycle directly prevent faulty FSM implementations in hardware logic.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can discover undefined FSM states before deployment.
Secure development lifecycle includes hardware design reviews that can catch FSM flaws.
Secure system architecture and engineering principles directly address proper FSM design and state validation.
Secure coding guidelines can extend to hardware description languages to prevent FSM coding errors.
Change management ensures hardware logic modifications do not introduce new FSM weaknesses.