// For flags

CVE-2020-12138

 

Severity Score

8.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

AMD ATI atillk64.sys 5.11.9.0 allows low-privileged users to interact directly with physical memory by calling one of several driver routines that map physical memory into the virtual address space of the calling process. This could enable low-privileged users to achieve NT AUTHORITY\SYSTEM privileges via a DeviceIoControl call associated with MmMapIoSpace, IoAllocateMdl, MmBuildMdlForNonPagedPool, or MmMapLockedPages.

AMD ATI atillk64.sys versión 5.11.9.0, permite a usuarios poco privilegiados interactuar directamente con la memoria física al llamar a una de las varias rutinas de controladores que asignan la memoria física al espacio de direcciones virtuales del proceso de llamada. Esto podría permitir a usuarios pocos privilegiados alcanzar los privilegios NT AUTHORITY\SYSTEM por medio de una llamada de DeviceIoControl asociada con MmMapIoSpace, IoAllocateMdl, MmBuildMdlForNonPagedPool, o MmMapLockedPages.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
Single
Confidentiality
Complete
Integrity
Complete
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2020-04-24 CVE Reserved
  • 2020-04-27 CVE Published
  • 2023-08-31 EPSS Updated
  • 2024-08-04 CVE Updated
  • 2024-08-04 First Exploit
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-862: Missing Authorization
CAPEC
References (2)
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Amd
Search vendor "Amd"
Atillk64
Search vendor "Amd" for product "Atillk64"
5.11.9.0
Search vendor "Amd" for product "Atillk64" and version "5.11.9.0"
-
Affected