// For flags

CVE-2020-6101

 

Severity Score

9.9
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.dll 26.20.15019.19000. An attacker can provide a specially crafted shader file to trigger this vulnerability, resulting in code execution. This vulnerability can be triggered from a HYPER-V guest using the RemoteFX feature, leading to executing the vulnerable code on the HYPER-V host (inside of the rdvgm.exe process). Theoretically this vulnerability could be also triggered from web browser (using webGL and webassembly).

Se presenta una vulnerabilidad de ejecución de código explotable en la funcionalidad Shader del Driver atidxx64.dll de AMD Radeon DirectX 11 versión 26.20.15019.19000. Un atacante puede proporcionar un archivo shader especialmente diseñado para activar esta vulnerabilidad, resultando en una ejecución de código. Esta vulnerabilidad puede ser desencadenada desde un invitado HYPER-V utilizando la funcionalidad RemoteFX, conllevando a ejecutar el código vulnerable en el host HYPER-V (dentro del proceso rdvgm.exe). Teóricamente, esta vulnerabilidad podría ser activada también desde el navegador web (usando webGL y webassembly)

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
Single
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2020-01-07 CVE Reserved
  • 2020-07-20 CVE Published
  • 2023-11-23 EPSS Updated
  • 2024-08-04 CVE Updated
  • 2024-08-04 First Exploit
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-787: Out-of-bounds Write
CAPEC
References (1)
URL Tag Source
URL Date SRC
https://talosintelligence.com/vulnerability_reports/TALOS-2020-1041 2024-08-04
URL Date SRC
URL Date SRC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Amd
Search vendor "Amd"
 Radeon Directx 11 Driver Atidxx64.dll
Search vendor "Amd" for product "Radeon Directx 11 Driver Atidxx64.dll"
 26.20.15019.19000
Search vendor "Amd" for product "Radeon Directx 11 Driver Atidxx64.dll" and version "26.20.15019.19000"
-
Affected