Memory corruption flaw in AMD Radeon driver allows VM escape

Experts at Cisco Talos group discovered a vulnerability in the AMD ATI Radeon ATIDXX64.DLL driver that could lead to VM escape.

Researchers at Cisco Talos group discovered a vulnerability in the AMD ATI Radeon ATIDXX64.DLL driver that be exploited by an attacker to escale the VM and execute code on the host.

This flaw affects the AMD Radeon RX 550 and the 550 series video cards and it could be exploited only when running VMWare Workstation 15.

The issue is an out-of-bounds memory write that could be triggered via a malformed pixel shader inside the VMware guest OS, to the AMD ATIDXX64.DLL driver.

“Some AMD Radeon cards contain a remote code execution vulnerability in their ATIDXX64.DLL driver. AMD produces the Radeon line of hardware, which includes graphics cards and graphics processing units. This specific vulnerability exists on the Radeon RX 550 and the 550 Series while running VMWare Workstation 15.” reads the post published by Talos.

The vulnerability, tracked as CVE-2019-5049, has received a CVSS score of 9.0.

The flaw affects the ATIDXX64.DLL driver versions 25.20.15031.5004 and 25.20.15031.9002, it can only be exploited when VMware Workstation 15 version, 15.0.4,build-12990004 with Windows 10 x64 as the guestVM is running.

“An attacker could exploit this vulnerability by supplying a malformed pixel shared inside the VMware guest operating system to the driver. This could corrupt memory in a way that would allow the attacker to gain the ability to remotely execute code on the victim machine,” Talos continues.

The Talos team reported the flaw to AMD in early May and the vendor addressed it this week.

The experts released the following SNORT rules to detect exploitation attempts: Snort Rules: 49978, 49979

Cisco credited Piotr Bania of Cisco Talos for the discovery of this vulnerability.

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – AMD Radeon, hacking)

[adrotate banner=”5″]

[adrotate banner=”13″]