CVE-2020-6100

An exploitable memory corruption vulnerability exists in AMD atidxx64.dll 26.20.15019.19000 graphics driver. A specially crafted pixel shader can cause memory corruption vulnerability. An attacker can provide a specially crafted shader file to trigger this vulnerability. This vulnerability potentially could be triggered from guest machines running virtualization environments (ie. VMware, qemu, VirtualBox etc.) in order to perform guest-to-host escape - as it was demonstrated before (TALOS-2018-0533, TALOS-2018-0568, etc.). Theoretically this vulnerability could be also triggered from web browser (using webGL and webassembly). This vulnerability was triggered from HYPER-V guest using RemoteFX feature leading to executing the vulnerable code on the HYPER-V host (inside of the rdvgm.exe process).

CVSS v3 9.9 CRITICAL
CVSS v2.0 6.5 MEDIUM

9.9^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.1 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

6.5^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://talosintelligence.com/vulnerability_reports/TALOS-2020-1040	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:amd:radeon_directx_11_driver_atidxx64.dll:26.20.15019.19000:*:*:*:*:*:*:*

History

No history.

Information

Published : 2020-07-20 21:15

Updated : 2023-12-10 13:27

NVD link : CVE-2020-6100

Mitre link : CVE-2020-6100

CVE.ORG link : CVE-2020-6100

JSON object : View

Products Affected

amd

radeon_directx_11_driver_atidxx64.dll

CWE

CWE-787

Out-of-bounds Write

{"id": "CVE-2020-6100", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.1}]}, "published": "2020-07-20T21:15:12.733", "references": [{"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2020-1040", "tags": ["Exploit", "Third Party Advisory"], "source": "talos-cna@cisco.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "An exploitable memory corruption vulnerability exists in AMD atidxx64.dll 26.20.15019.19000 graphics driver. A specially crafted pixel shader can cause memory corruption vulnerability. An attacker can provide a specially crafted shader file to trigger this vulnerability. This vulnerability potentially could be triggered from guest machines running virtualization environments (ie. VMware, qemu, VirtualBox etc.) in order to perform guest-to-host escape - as it was demonstrated before (TALOS-2018-0533, TALOS-2018-0568, etc.). Theoretically this vulnerability could be also triggered from web browser (using webGL and webassembly). This vulnerability was triggered from HYPER-V guest using RemoteFX feature leading to executing the vulnerable code on the HYPER-V host (inside of the rdvgm.exe process)."}, {"lang": "es", "value": "Se presenta una vulnerabilidad de corrupci\u00f3n de memoria explotable en el controlador de gr\u00e1ficos atidxx64.dll de AMD versi\u00f3n 26.20.15019.19000. Un sombreador de p\u00edxeles especialmente dise\u00f1ado puede causar una vulnerabilidad de corrupci\u00f3n de memoria. Un atacante puede proporcionar un archivo shader especialmente dise\u00f1ado para desencadenar esta vulnerabilidad. Esta vulnerabilidad podr\u00eda ser desencadenada potencialmente desde m\u00e1quinas invitadas que ejecutan entornos de virtualizaci\u00f3n (es decir, VMware, qemu, VirtualBox, etc.) en funci\u00f3n de llevar a cabo el escape de invitado a host, como fue demostrado antes (TALOS-2018-0533, TALOS-2018- 0568, etc.). Te\u00f3ricamente, esta vulnerabilidad podr\u00eda ser activada tambi\u00e9n desde el navegador web (usando webGL y webassembly). Esta vulnerabilidad fue desencadenada desde el invitado HYPER-V utilizando la funcionalidad RemoteFX conllevando a una ejecuci\u00f3n de c\u00f3digo vulnerable en el host HYPER-V (dentro del proceso rdvgm.exe)"}], "lastModified": "2020-07-24T16:59:10.653", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:amd:radeon_directx_11_driver_atidxx64.dll:26.20.15019.19000:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "81578A1D-D11C-480F-B836-76C976B4B536"}], "operator": "OR"}]}], "sourceIdentifier": "talos-cna@cisco.com"}