Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cveTalosCVE-2019-5049
HistoryOct 31, 2019 - 8:15 p.m.

CVE-2019-5049

2019-10-3120:15:11
CWE-787
talos
web.nvd.nist.gov
47
amd
atidxx64.dll
driver
memory corruption
vulnerability
exploit
amd
atidxx64.dll
vmware
nvd

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

10

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

AI Score

9.3

Confidence

High

EPSS

0.002

Percentile

60.7%

JSON

An exploitable memory corruption vulnerability exists in AMD ATIDXX64.DLL driver, versions 25.20.15031.5004 and 25.20.15031.9002. A specially crafted pixel shader can cause an out-of-bounds memory write. An attacker can provide a specially crafted shader file to trigger this vulnerability. This vulnerability can be triggered from VMware guest, affecting VMware host.

Affected configurations

Nvd
Node
amdradeon_rx_550_firmwareMatch25.20.15031.5004
OR
amdradeon_rx_550_firmwareMatch25.20.15031.9002
AND
amdradeon_rx_550Match-
Node
amdradeon_550_firmwareMatch25.20.15031.5004
OR
amdradeon_550_firmwareMatch25.20.15031.9002
AND
amdradeon_550Match-
Node
amdradeon_rx_550x_firmwareMatch25.20.15031.5004
OR
amdradeon_rx_550x_firmwareMatch25.20.15031.9002
AND
amdradeon_rx_550xMatch-
VendorProductVersionCPE
amdradeon_rx_550_firmware25.20.15031.5004cpe:2.3:o:amd:radeon_rx_550_firmware:25.20.15031.5004:*:*:*:*:*:*:*
amdradeon_rx_550_firmware25.20.15031.9002cpe:2.3:o:amd:radeon_rx_550_firmware:25.20.15031.9002:*:*:*:*:*:*:*
amdradeon_rx_550-cpe:2.3:h:amd:radeon_rx_550:-:*:*:*:*:*:*:*
amdradeon_550_firmware25.20.15031.5004cpe:2.3:o:amd:radeon_550_firmware:25.20.15031.5004:*:*:*:*:*:*:*
amdradeon_550_firmware25.20.15031.9002cpe:2.3:o:amd:radeon_550_firmware:25.20.15031.9002:*:*:*:*:*:*:*
amdradeon_550-cpe:2.3:h:amd:radeon_550:-:*:*:*:*:*:*:*
amdradeon_rx_550x_firmware25.20.15031.5004cpe:2.3:o:amd:radeon_rx_550x_firmware:25.20.15031.5004:*:*:*:*:*:*:*
amdradeon_rx_550x_firmware25.20.15031.9002cpe:2.3:o:amd:radeon_rx_550x_firmware:25.20.15031.9002:*:*:*:*:*:*:*
amdradeon_rx_550x-cpe:2.3:h:amd:radeon_rx_550x:-:*:*:*:*:*:*:*

CNA Affected

[
  {
    "product": "AMD ATI",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "AMD ATIDXX64.DLL (25.20.15031.5004 / 25.20.15031.9002) running on Radeon RX 550 / 550 Series VMware Workstation 15 (15.0.4 build-12990004) with Windows 10 x64 as guestVM"
      }
    ]
  }
]

Related

prion 1
threatpost 1
talosblog 1
talos 1
cvelist 1
nvd 1
prion
prion
Memory corruption
2019-10-31 20:15:00
threatpost
threatpost
AMD Radeon Graphics Cards Open VMware Workstations to Attack
2019-09-17 17:03:36
talosblog
talosblog
Vulnerability Spotlight: AMD ATI Radeon ATIDXX64.DLL shader functionality remote code execution vulnerability
2019-09-17 05:40:57
talos
talos
AMD ATI Radeon ATIDXX64.DLL shader functionality remote code execution vulnerability
2019-09-16 00:00:00
cvelist
cvelist
CVE-2019-5049
2019-10-31 19:54:48
nvd
nvd
CVE-2019-5049
2019-10-31 20:15:11

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

10

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

AI Score

9.3

Confidence

High

EPSS

0.002

Percentile

60.7%

JSON
Related for CVE-2019-5049
prion1threatpost1talosblog1talos1cvelist1nvd1