Experts at Cisco Talos group discovered a vulnerability in the AMD ATI Radeon ATIDXX64.DLL driver that could lead to VM escape.
Researchers at Cisco Talos group discovered a vulnerability in the AMD ATI Radeon ATIDXX64.DLL driver that be exploited by an attacker to escale the VM and execute code on the host.
This flaw affects the AMD Radeon RX 550 and the 550 series video cards and it could be exploited only when running VMWare Workstation 15.
The issue is an out-of-bounds memory write that could be triggered via a malformed pixel shader inside the VMware guest OS, to the AMD ATIDXX64.DLL driver.
“Some AMD Radeon cards contain a remote code execution vulnerability in their ATIDXX64.DLL driver. AMD produces the Radeon line of hardware, which includes graphics cards and graphics processing units. This specific vulnerability exists on the Radeon RX 550 and the 550 Series while running VMWare Workstation 15.” reads the post published by Talos.
The vulnerability, tracked as CVE-2019-5049, has received a CVSS score of 9.0.
The flaw affects the ATIDXX64.DLL driver versions 25.20.15031.5004 and 25.20.15031.9002, it can only be exploited when VMware Workstation 15 version, 15.0.4,build-12990004 with Windows 10 x64 as the guestVM is running.
“An attacker could exploit this vulnerability by supplying a malformed pixel shared inside the VMware guest operating system to the driver. This could corrupt memory in a way that would allow the attacker to gain the ability to remotely execute code on the victim machine,” Talos continues.
The Talos team reported the flaw to AMD in early May and the vendor addressed it this week.
The experts released the following SNORT rules to detect exploitation attempts: Snort Rules: 49978, 49979
Cisco credited Piotr Bania of Cisco Talos for the discovery of this vulnerability.
Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer.
Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US.
Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines.
Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.