CVE-2020-6100 Memory corruption in AMD
A memory corruption flaw in the AMD graphics driver allows attackers to execute arbitrary code and escape virtualization environments via crafted shaders.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-6100?
CVE-2020-6100 is a critical memory corruption vulnerability in AMD, published on 20 Jul 2020. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An exploitable memory corruption vulnerability exists in AMD atidxx64.dll 26.20.15019.19000 graphics driver. A specially crafted pixel shader can cause memory corruption vulnerability. An attacker can provide a specially crafted shader file to trigger this vulnerability. This vulnerability potentially could be triggered from guest machines running virtualization environments (ie. VMware, qemu, VirtualBox etc.) in order to perform guest-to-host escape - as it was demonstrated before (TALOS-2018-0533, TALOS-2018-0568, etc.). Theoretically this vulnerability could be also triggered from web browser (using webGL and webassembly). This vulnerability was triggered from HYPER-V guest using RemoteFX feature leading to executing the vulnerable code on the HYPER-V host (inside of the rdvgm.exe process).
Weakness: CWE-787
Which versions are affected by CVE-2020-6100?
It affects 1 product.
Products include Amd Radeon Directx 11 Driver Atidxx64.dll.
How do I fix CVE-2020-6100?
No fix has been published for CVE-2020-6100 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2020-6100 being exploited?
There is no known exploitation of CVE-2020-6100 in the wild and no public exploit code.
Other vulnerabilities in AMD
Sources
Also known as GHSA-w72r-jmv8-r4gh.