CVE-2019-5183

An exploitable type confusion vulnerability exists in AMD ATIDXX64.DLL driver, versions 26.20.13031.10003, 26.20.13031.15006 and 26.20.13031.18002

published January 25, 2020

CVSS
—
EPSS
2%
Percentile
78.4
In the wild
Unconfirmed
What it is

⚠️ A crafty pixel shader can turn your graphics driver into a gateway for trouble! This type confusion vulnerability in AMD's ATIDXX64.DLL could let an attacker run their own code — yikes! Think of this as a restaurant where the chef suddenly starts cooking from the wrong recipe book, leading to some truly bizarre dishes. In this case, the pixel shader is like that recipe, mixing up the ingredients in a way that could cause chaos! If exploited, this vulnerability could allow an attacker to execute arbitrary code on the host, potentially leading to system compromise. Imagine a virtual guest being able to take over the entire kitchen and serve whatever they want — not a recipe for success!

Put simply

Think of this as a restaurant where the chef suddenly starts cooking from the wrong recipe book, leading to some truly bizarre dishes. In this case, the pixel shader is like that recipe, mixing up the ingredients in a way that could cause chaos! The type confusion vulnerability in AMD ATIDXX64.DLL occurs when a crafted pixel shader causes the driver to misinterpret the data types, allowing unauthorized code execution from a specially designed shader file — all while interacting with a VMware guest.

What to do

If exploited, this vulnerability could allow an attacker to execute arbitrary code on the host, potentially leading to system compromise. Imagine a virtual guest being able to take over the entire kitchen and serve whatever they want — not a recipe for success! To protect yourself, ensure you're using a patched version of the AMD driver. Versions prior to 26.20.13031.18002 are vulnerable, so update to the latest release immediately. It's also a good idea to review your VM configurations and restrict shader file access! You've got this! With these steps, you can keep your systems secure and your virtual kitchens running smoothly! 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01802 · 78.4th percentile
Published
2020-01-25T17:59Z
EPSS history
Timeline
  • 25 JAN 17:59Z
    An exploitable type confusion vulnerability exists in AMD ATIDXX64.DLL driver, versions 26.20.13031.10003, 26.20.13031.15006 and 26.20.13031.18002
    cvelistv5