CVE-2019-5049 - OpenCVE

An exploitable memory corruption vulnerability exists in AMD ATIDXX64.DLL driver, versions 25.20.15031.5004 and 25.20.15031.9002. A specially crafted pixel shader can cause an out-of-bounds memory write. An attacker can provide a specially crafted shader file to trigger this vulnerability. This vulnerability can be triggered from VMware guest, affecting VMware host.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

AV:N/AC:L/Au:N/C:P/I:P/A:P

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Amd	Radeon 550 Radeon 550 Firmware Radeon Rx 550 Radeon Rx 550 Firmware Radeon Rx 550x Radeon Rx 550x Firmware

Configuration 1 [-]

AND

OR	cpe:2.3:o:amd:radeon_rx_550_firmware:25.20.15031.5004:::::::*
	cpe:2.3:o:amd:radeon_rx_550_firmware:25.20.15031.9002:::::::*

cpe:2.3:h:amd:radeon_rx_550:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

OR	cpe:2.3:o:amd:radeon_550_firmware:25.20.15031.5004:::::::*
	cpe:2.3:o:amd:radeon_550_firmware:25.20.15031.9002:::::::*

cpe:2.3:h:amd:radeon_550:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

OR	cpe:2.3:o:amd:radeon_rx_550x_firmware:25.20.15031.5004:::::::*
	cpe:2.3:o:amd:radeon_rx_550x_firmware:25.20.15031.9002:::::::*

cpe:2.3:h:amd:radeon_rx_550x:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://talosintelligence.com/vulnerability_reports/TALOS-2019-0818

History

No history.

MITRE

Status: PUBLISHED

Assigner: talos

Published: 2019-10-31T19:54:48

Updated: 2024-08-04T19:47:56.577Z

Reserved: 2019-01-04T00:00:00

Link: CVE-2019-5049

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2019-10-31T20:15:11.257

Modified: 2019-11-07T18:42:48.603

Link: CVE-2019-5049

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "AMD ATI", "vendor": "n/a", "versions": [{"status": "affected", "version": "AMD ATIDXX64.DLL (25.20.15031.5004 / 25.20.15031.9002) running on Radeon RX 550 / 550 Series VMware Workstation 15 (15.0.4 build-12990004) with Windows 10 x64 as guestVM"}]}], "descriptions": [{"lang": "en", "value": "An exploitable memory corruption vulnerability exists in AMD ATIDXX64.DLL driver, versions 25.20.15031.5004 and 25.20.15031.9002. A specially crafted pixel shader can cause an out-of-bounds memory write. An attacker can provide a specially crafted shader file to trigger this vulnerability. This vulnerability can be triggered from VMware guest, affecting VMware host."}], "problemTypes": [{"descriptions": [{"description": "Out-of-bounds-write", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2019-10-31T19:54:48", "orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b", "shortName": "talos"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2019-0818"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "talos-cna@cisco.com", "ID": "CVE-2019-5049", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "AMD ATI", "version": {"version_data": [{"version_value": "AMD ATIDXX64.DLL (25.20.15031.5004 / 25.20.15031.9002) running on Radeon RX 550 / 550 Series VMware Workstation 15 (15.0.4 build-12990004) with Windows 10 x64 as guestVM"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "An exploitable memory corruption vulnerability exists in AMD ATIDXX64.DLL driver, versions 25.20.15031.5004 and 25.20.15031.9002. A specially crafted pixel shader can cause an out-of-bounds memory write. An attacker can provide a specially crafted shader file to trigger this vulnerability. This vulnerability can be triggered from VMware guest, affecting VMware host."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Out-of-bounds-write"}]}]}, "references": {"reference_data": [{"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2019-0818", "refsource": "MISC", "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2019-0818"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T19:47:56.577Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2019-0818"}]}]}, "cveMetadata": {"assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b", "assignerShortName": "talos", "cveId": "CVE-2019-5049", "datePublished": "2019-10-31T19:54:48", "dateReserved": "2019-01-04T00:00:00", "dateUpdated": "2024-08-04T19:47:56.577Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:amd:radeon_rx_550_firmware:25.20.15031.5004:*:*:*:*:*:*:*", "matchCriteriaId": "8BC742FD-ECF0-4547-8F3E-D9A7116C92C3", "vulnerable": true}, {"criteria": "cpe:2.3:o:amd:radeon_rx_550_firmware:25.20.15031.9002:*:*:*:*:*:*:*", "matchCriteriaId": "AD8D6240-7843-4CE8-9DA8-40650EBC4C76", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:amd:radeon_rx_550:-:*:*:*:*:*:*:*", "matchCriteriaId": "59243C37-3522-4295-901A-B04D2D72D7A3", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:amd:radeon_550_firmware:25.20.15031.5004:*:*:*:*:*:*:*", "matchCriteriaId": "A5D3DEF9-52E6-43F9-96E4-17A0AF6C7BC1", "vulnerable": true}, {"criteria": "cpe:2.3:o:amd:radeon_550_firmware:25.20.15031.9002:*:*:*:*:*:*:*", "matchCriteriaId": "08191311-9E72-4D36-A772-8A3F50412A33", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:amd:radeon_550:-:*:*:*:*:*:*:*", "matchCriteriaId": "5084CEE6-8FFF-41A3-9346-4B4DE5F6C16B", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:amd:radeon_rx_550x_firmware:25.20.15031.5004:*:*:*:*:*:*:*", "matchCriteriaId": "DC399CAC-F513-4F43-819E-8C0C68814274", "vulnerable": true}, {"criteria": "cpe:2.3:o:amd:radeon_rx_550x_firmware:25.20.15031.9002:*:*:*:*:*:*:*", "matchCriteriaId": "C08FA221-F19F-47E5-B09F-82292B5FB1F2", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:amd:radeon_rx_550x:-:*:*:*:*:*:*:*", "matchCriteriaId": "829918E7-5443-4834-84CB-72F3147711B7", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An exploitable memory corruption vulnerability exists in AMD ATIDXX64.DLL driver, versions 25.20.15031.5004 and 25.20.15031.9002. A specially crafted pixel shader can cause an out-of-bounds memory write. An attacker can provide a specially crafted shader file to trigger this vulnerability. This vulnerability can be triggered from VMware guest, affecting VMware host."}, {"lang": "es", "value": "Se presenta una vulnerabilidad de corrupci\u00f3n de memoria explotable en el controlador AMD ATIDXX64.DLL, versiones 25.20.15031.5004 y 25.20.15031.9002. Un sombreador de p\u00edxeles especialmente dise\u00f1ado puede causar una escritura de memoria fuera de l\u00edmites. Un atacante puede proveer un archivo de sombreador especialmente dise\u00f1ado para activar esta vulnerabilidad. Esta vulnerabilidad puede ser activada desde el invitado de VMware, afectando al host de VMware."}], "id": "CVE-2019-5049", "lastModified": "2019-11-07T18:42:48.603", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 6.0, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-10-31T20:15:11.257", "references": [{"source": "talos-cna@cisco.com", "tags": ["Third Party Advisory"], "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2019-0818"}], "sourceIdentifier": "talos-cna@cisco.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}]}