Full Breakdown
AMD Auto-Updater Vulnerability and Bounty Dispute
6/13/2026, 12:39:44 PM
Background & Context
AMD’s Ryzen Master, µProf and Management Console utilities use an auto-updater that historically downloaded driver packages over unencrypted HTTP and validated them only with a CRC32 checksum. The company’s public bug-bounty program rewards remote-code-execution (RCE) flaws but excludes man-in-the-middle (MITM) attacks.
Timeline
27 Jan 2024 – Researcher Paul LaRosa (alias “MrBruh”) discovers the HTTP download flaw.
6 Feb 2024 – He submits a report to AMD’s bounty portal.
Feb 2024 – AMD labels the report “out of scope” and asks for delayed public disclosure, promising a fix within 90 days.
Mar-May 2024 – AMD requests extensions, citing additional tools.
9 Jun 2024 – Patch released, 124 days after initial report.
Post-Jun 2024 – AMD revises bounty policy to require written consent before any disclosure, even for out-of-scope findings.
Technical Details & Data
The updater fetched driver binaries via HTTP, allowing a network-adjacent attacker to replace them with malicious code and achieve remote code execution because the updater runs with elevated privileges. The flaw was assigned CVE-2026-40677 and a CVSS 7.7 score. AMD’s patch switched download URLs to HTTPS and added signature verification, but verification still relies on CRC32, a non-cryptographic checksum.
Official Statements
AMD confirmed that the vulnerability existed and that the updated updater now uses HTTPS for all communications. The company said updates are verified, though it did not disclose the cryptographic method. AMD’s response to the bounty claim emphasized that MITM attacks are outside the program’s scope, and the revised policy now requires written consent before any disclosure, even for out-of-scope reports.
Criticism & Opposition
Security analysts and users criticized the four-month remediation, noting that industry best practice for critical RCE bugs calls for patches within 5-14 days. The researcher highlighted that CRC32 does not provide cryptographic assurance, and community members recommended uninstalling AMD utilities until a fully signed update mechanism is confirmed.
Conflicting Reports & Gaps
A Reddit comment claimed the vulnerable code path was never invoked, suggesting the updater could not self-update and required a fresh download. AMD has not addressed this claim, leaving uncertainty about exploitability. The adequacy of CRC32 as a validation method remains disputed.
Verbatim Quotes
- “likely need a longer embargo, as additional tools beyond Ryzen Master appear[ed] to be impacted and [would] need releases.” — AMD representative (TechPower)
- “out of scope,” — AMD bug-bounty program (TechSpot)
- “To its credit, AMD seemingly reengineered the download code in the autoupdater altogether, and Paul verified that the new version does indeed download drivers securely, though he remarks that the software only checks the validity of the downloaded file using the ancient CRC32 hash that isn't considered cryptographically secure anymore.” — Paul LaRosa (researcher)
- “AMD has denied a security researcher a $10,000 bug bounty despite the individual's work and cooperation with the company.” — TechSpot report
Future Outlook
The HTTPS-only updater and revised bounty policy are steps forward, but reliance on CRC32 and unanswered questions about exploitability indicate further security review is needed. Independent audits and clearer eligibility criteria are likely to shape AMD’s future vulnerability-handling practices.
