Buffer overflow in AMD Radeon Directx 11 Driver Atidxx64.dll

CVE-2020-6102

An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.dll 26.20.15019.19000. An attacker can provide a a specially crafted shader file to trigger this vulnerability, resulting in code execution. This vulnerability can be triggered from a HYPER-V guest using the RemoteFX feature, leading to executing the vulnerable code on the HYPER-V host (inside of the rdvgm.exe process). Theoretically this vulnerability could be also triggered from web browser (using webGL and webassembly).

Vulnerability class: Buffer Overflow

Published · last modified .

CVSS v3 metric

CVSS v3 base score 9.9 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.027 (85.4th percentile), scored .

Low probability of exploitation in the next 30 days, but still tracked. 85th percentile — 85.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2020-6102: held from 0.028 to 0.027.

EPSS over last 30 days · oldest: 0.028 · newest: 0.027 · change: -0.001

Affected products

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2020-6102?
CVE-2020-6102 is a critical-severity vulnerability in AMD Radeon Directx 11 Driver Atidxx64.dll, classified under Out-of-bounds Write. CVSS score: 9.9/10. Published 2020-07-20.
How severe is CVE-2020-6102?
Critical severity. CVSS v3 base score is 9.9 out of 10.