# AMD Ionic Cloud Driver Vulnerabilities Affecting VMware ESX (CVE-2025-62623, CVE-2025-62624, CVE-2025-62627)

> AMD and VMware disclosed three vulnerabilities in AMD's ionic cloud driver for VMware ESX hosts using AMD-Pensando DPU hardware, reported through the AMD Bug Bounty Program. CVE-2025-62623 and CVE-2025-62624 are heap-based buffer overflows enabling privilege escalation and potential arbitrary code execution; CVE-2025-62627 is an untrusted pointer dereference letting an unprivileged guest VM read hypervisor kernel memory or co-located guest VM memory, breaking tenant isolation.

- **Published:** 2026-08-25T00:00:00Z
- **Last reviewed:** 2026-08-25T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2146
- **ID:** TL-2026-2146
- **Severity:** HIGH (CVSS 8.8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 16 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-62623, CVE-2025-62624, CVE-2025-62627

## Description

AMD and VMware jointly disclosed three vulnerabilities in the AMD ionic cloud driver -- the kernel-mode component in VMware ESXi that services AMD-Pensando Distributed Services Card (DPU/SmartNIC) hardware -- affecting ESXi 8.x and 9.x hosts. All three were reported to AMD through its Bug Bounty Program by researcher Ori Nimron (@orinimron123). CVE IDs were reserved on 2025-10-16, well before the coordinated public disclosure on 2026-05-12, indicating a multi-month private remediation window between AMD, VMware/Broadcom, and the researcher. The vulnerabilities are documented in AMD Security Bulletin AMD-SB-2001, referenced from a VMware Security Blog post published the same day as initial disclosure.

CVE-2025-62623 (CWE-119, Improper Restriction of Operations within the Bounds of a Memory Buffer) and CVE-2025-62624 (CWE-122, Heap-based Buffer Overflow) are both heap-based buffer overflows in the ionic driver. Both carry an identical CVSS 4.0 vector (AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H, base score 8.8): exploitation requires local access and only low privileges -- consistent with an attacker who already has code execution inside a guest VM on the affected host -- with no user interaction, though attack complexity is high. Successful exploitation could let that attacker perform operations beyond the intended memory buffer boundaries, escalate privileges, and potentially execute arbitrary code on the ESXi host itself, breaking out of the guest VM's intended boundary through the DPU driver interface. Both vulnerability-impact and subsequent-system-impact metrics (VC/VI/VA and SC/SI/SA) are rated High, reflecting total confidentiality, integrity, and availability compromise of the host, not just the guest.

CVE-2025-62627 (CWE-822, Untrusted Pointer Dereference, CVSS 4.0 7.2, vector AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:L/VA:H/SC:H/SI:L/SA:H) is an untrusted pointer dereference in the same driver: it dereferences a pointer that originates from, or is influenced by, an untrusted source without validating that the pointer references memory the caller is permitted to access. An attacker operating within an unprivileged guest VM issues crafted requests to the ionic driver interface to induce reads of arbitrary kernel addresses or addresses mapped to neighboring guests. This directly undermines the tenant-isolation guarantee that multi-tenant virtualization depends on: a low-privileged tenant VM could read hypervisor kernel memory or memory contents belonging to a separate, higher-value tenant's VM on the same physical host. The vector's VA:H/SA:H components also indicate a meaningful availability impact (e.g., driver/host crash from an invalid dereference), not just confidentiality loss.

None of the three CVEs appear in the CISA Known Exploited Vulnerabilities catalog as of 2026-08-25, and no public proof-of-concept or exploit code has been identified; CISA's SSVC assessment (ADP v2.0.3, recorded 2026-05-13) rates CVE-2025-62627's exploitation status as 'none', the attack as not automatable, and technical impact as 'partial'; the CVE carries an EPSS score of 0.00097 (0.797th percentile) -- a very low probability of near-term exploitation. CVE-2025-62623 independently shows an EPSS of roughly 0.02%, consistent with the same assessment. The vulnerabilities surfaced through responsible disclosure via AMD's bug bounty program rather than in-the-wild observation. On 2026-05-14, Red Hat Product Security separately assessed the ionic-driver CVEs and determined they do not affect any currently supported Red Hat product, since the vulnerable component is specific to VMware ESXi's driver integration rather than the upstream/mainline Linux kernel.

The 'ionic' driver name traces to AMD-Pensando's open-source out-of-tree driver family published at github.com/pensando/dsc-drivers, which packages three related kernel modules -- ionic/ionic_mnic (the network interface driver, with a separate PCI-bus build for standard hosts and a platform-bus 'mnic' build for the DSC's internal Arm complex), mnet (ioctl-based network-port management), and mnet_uio_pdrv_genirq (a UIO interface for userspace I/O). VMware ESXi ships its own in-tree adaptation of this driver family as the vulnerable 'ionic cloud driver'; the affected DPU hardware spans AMD's full current Distributed Services Card lineup -- DSC-25 (dual-port 25G), DSC-100 (dual-port 100G), DSC2-200 (dual-port 200G), and DSC3-400 (dual-port 400G).

AMD and VMware recommend remediation via VMware ESXi 8.0U3i (bundled in VMware Cloud Foundation 5.2.3.0) or VMware Cloud Foundation 9.0.2, both of which include the fix; no interim workaround has been published. Because AMD-Pensando DPUs are deployed specifically in shared, multi-tenant ESXi environments using SmartNIC offload, practical exposure concentrates in cloud hosting providers and enterprises running dense multi-tenant ESXi clusters on this hardware.

## MITRE ATT&CK

- T1199 Trusted Relationship
- T1611 Escape to Host
- T1082 System Information Discovery
- T1005 Data from Local System
- T1499.004 Application or System Exploitation
- T1588.006 Vulnerabilities
- T1583.003 Virtual Private Server
- T1580 Cloud Infrastructure Discovery
- T1592.004 Client Configurations

## Sources

- [AMD Ionic Driver Vulnerabilities Affecting VMware ESX](https://blogs.vmware.com/security/2026/05/amd-ionic-driver-vulnerabilities-affecting-vmware-esx.html)
- [AMD-SB-2001: Ionic Driver Vulnerabilities](https://www.amd.com/en/resources/product-security/bulletin/amd-sb-2001.html)
- [CVE-2025-62623 Detail](https://nvd.nist.gov/vuln/detail/CVE-2025-62623)
- [CVE-2025-62624 Detail](https://nvd.nist.gov/vuln/detail/CVE-2025-62624)
- [CVE-2025-62627 Detail](https://nvd.nist.gov/vuln/detail/CVE-2025-62627)
- [CVE-2025-62623 Official CVE Record](https://www.cve.org/CVERecord?id=CVE-2025-62623)
- [CVE-2025-62624 Official CVE Record](https://www.cve.org/CVERecord?id=CVE-2025-62624)
- [CVE-2025-62627 Official CVE Record](https://www.cve.org/CVERecord?id=CVE-2025-62627)
- [CVE-2025-62627: VMware ESXi Information Disclosure Flaw](https://www.sentinelone.com/vulnerability-database/cve-2025-62627/)
- [CVE-2025-62623 Vulnerability-Lookup Record](https://vulnerability.circl.lu/vuln/cve-2025-62623)
- [CVE-2025-62624 Vulnerability-Lookup Record](https://vulnerability.circl.lu/vuln/cve-2025-62624)
- [CVE-2025-62627 Vulnerability-Lookup Record](https://vulnerability.circl.lu/vuln/cve-2025-62627)
- [CVE-2025-62623 Threat Radar Analysis](https://radar.offseq.com/threat/cve-2025-62623-cwe-119-improper-restriction-of-ope-c069ceb0)
- [CVE-2025-62623 THREATINT Record](https://cve.threatint.com/CVE/CVE-2025-62623)
- [CVE-2025-62624 THREATINT Record](https://cve.threatint.com/CVE/CVE-2025-62624)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2146