CVE-2019-5049 Memory corruption in AMD ATI
A crafted pixel shader in the AMD GPU driver causes out-of-bounds memory writes, allowing attackers to execute code or escalate privileges, potentially escaping virtual machines.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-5049?
CVE-2019-5049 is a critical memory corruption vulnerability in AMD ATI, published on 31 Oct 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An exploitable memory corruption vulnerability exists in AMD ATIDXX64.DLL driver, versions 25.20.15031.5004 and 25.20.15031.9002. A specially crafted pixel shader can cause an out-of-bounds memory write. An attacker can provide a specially crafted shader file to trigger this vulnerability. This vulnerability can be triggered from VMware guest, affecting VMware host.
Weakness: CWE-787
Which versions are affected by CVE-2019-5049?
It affects 3 products.
Products include Amd Radeon 550 Firmware, Amd Radeon Rx 550 Firmware, Amd Radeon Rx 550x Firmware.
How do I fix CVE-2019-5049?
No fix has been published for CVE-2019-5049 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2019-5049 being exploited?
There is no known exploitation of CVE-2019-5049 in the wild and no public exploit code.
Other vulnerabilities in AMD ATI
Sources
Also known as GHSA-7p5r-q7hh-vhjj.