CVE-2019-5049 — CRITICAL (10.0)

Vulnerability Description

An exploitable memory corruption vulnerability exists in AMD ATIDXX64.DLL driver, versions 25.20.15031.5004 and 25.20.15031.9002. A specially crafted pixel shader can cause an out-of-bounds memory write. An attacker can provide a specially crafted shader file to trigger this vulnerability. This vulnerability can be triggered from VMware guest, affecting VMware host.

CVSS Score

10.0

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Amd	Radeon Rx 550 Firmware	25.20.15031.5004
Amd	Radeon Rx 550	-
Amd	Radeon 550 Firmware	25.20.15031.5004
Amd	Radeon 550	-
Amd	Radeon Rx 550X Firmware	25.20.15031.5004
Amd	Radeon Rx 550X	-

Related Weaknesses (CWE)

CWE-787

References

https://talosintelligence.com/vulnerability_reports/TALOS-2019-0818Third Party Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2019-0818Third Party Advisory

FAQ

What is CVE-2019-5049?

CVE-2019-5049 is a vulnerability with a CVSS score of 10.0 (CRITICAL). An exploitable memory corruption vulnerability exists in AMD ATIDXX64.DLL driver, versions 25.20.15031.5004 and 25.20.15031.9002. A specially crafted pixel shader can cause an out-of-bounds memory wri...

How severe is CVE-2019-5049?

CVE-2019-5049 has been rated CRITICAL with a CVSS base score of 10.0/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2019-5049?

Check the references section above for vendor advisories and patch information. Affected products include: Amd Radeon Rx 550 Firmware, Amd Radeon Rx 550, Amd Radeon 550 Firmware, Amd Radeon 550, Amd Radeon Rx 550X Firmware.