FKIE_CVE-2019-5049

Vulnerability from fkie_nvd - Published: 2019-10-31 20:15 - Updated: 2024-11-21 04:44
Severity ?
10.0 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Summary
An exploitable memory corruption vulnerability exists in AMD ATIDXX64.DLL driver, versions 25.20.15031.5004 and 25.20.15031.9002. A specially crafted pixel shader can cause an out-of-bounds memory write. An attacker can provide a specially crafted shader file to trigger this vulnerability. This vulnerability can be triggered from VMware guest, affecting VMware host.
References
talos-cna@cisco.comhttps://talosintelligence.com/vulnerability_reports/TALOS-2019-0818Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://talosintelligence.com/vulnerability_reports/TALOS-2019-0818Third Party Advisory
Impacted products
Vendor Product Version
amd radeon_rx_550_firmware 25.20.15031.5004
amd radeon_rx_550_firmware 25.20.15031.9002
amd radeon_rx_550 -
amd radeon_550_firmware 25.20.15031.5004
amd radeon_550_firmware 25.20.15031.9002
amd radeon_550 -
amd radeon_rx_550x_firmware 25.20.15031.5004
amd radeon_rx_550x_firmware 25.20.15031.9002
amd radeon_rx_550x -
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:amd:radeon_rx_550_firmware:25.20.15031.5004:*:*:*:*:*:*:*",
              "matchCriteriaId": "8BC742FD-ECF0-4547-8F3E-D9A7116C92C3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:amd:radeon_rx_550_firmware:25.20.15031.9002:*:*:*:*:*:*:*",
              "matchCriteriaId": "AD8D6240-7843-4CE8-9DA8-40650EBC4C76",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:amd:radeon_rx_550:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "59243C37-3522-4295-901A-B04D2D72D7A3",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:amd:radeon_550_firmware:25.20.15031.5004:*:*:*:*:*:*:*",
              "matchCriteriaId": "A5D3DEF9-52E6-43F9-96E4-17A0AF6C7BC1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:amd:radeon_550_firmware:25.20.15031.9002:*:*:*:*:*:*:*",
              "matchCriteriaId": "08191311-9E72-4D36-A772-8A3F50412A33",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:amd:radeon_550:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "5084CEE6-8FFF-41A3-9346-4B4DE5F6C16B",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:amd:radeon_rx_550x_firmware:25.20.15031.5004:*:*:*:*:*:*:*",
              "matchCriteriaId": "DC399CAC-F513-4F43-819E-8C0C68814274",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:amd:radeon_rx_550x_firmware:25.20.15031.9002:*:*:*:*:*:*:*",
              "matchCriteriaId": "C08FA221-F19F-47E5-B09F-82292B5FB1F2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:amd:radeon_rx_550x:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "829918E7-5443-4834-84CB-72F3147711B7",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An exploitable memory corruption vulnerability exists in AMD ATIDXX64.DLL driver, versions 25.20.15031.5004 and 25.20.15031.9002. A specially crafted pixel shader can cause an out-of-bounds memory write. An attacker can provide a specially crafted shader file to trigger this vulnerability. This vulnerability can be triggered from VMware guest, affecting VMware host."
    },
    {
      "lang": "es",
      "value": "Se presenta una vulnerabilidad de corrupci\u00f3n de memoria explotable en el controlador AMD ATIDXX64.DLL, versiones 25.20.15031.5004 y 25.20.15031.9002. Un sombreador de p\u00edxeles especialmente dise\u00f1ado puede causar una escritura de memoria fuera de l\u00edmites. Un atacante puede proveer un archivo de sombreador especialmente dise\u00f1ado para activar esta vulnerabilidad. Esta vulnerabilidad puede ser activada desde el invitado de VMware, afectando al host de VMware."
    }
  ],
  "id": "CVE-2019-5049",
  "lastModified": "2024-11-21T04:44:14.950",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 10.0,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 6.0,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2019-10-31T20:15:11.257",
  "references": [
    {
      "source": "talos-cna@cisco.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2019-0818"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2019-0818"
    }
  ],
  "sourceIdentifier": "talos-cna@cisco.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.