SB2020100808 - Multiple vulnerabilities in AMD ATIKMDAG.SYS

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Out-of-bounds read (CVE-ID: CVE-2020-12911)

The vulnerability allows a local attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary condition in the D3DKMTCreateAllocation handler functionality. A local attacker can send a specially crafted D3DKMTCreateAllocation API request, trigger out-of-bounds read error and cause a denial of service condition on the system.

2) Out-of-bounds read (CVE-ID: CVE-2020-12933)

The vulnerability allows a local attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary condition in the D3DKMTEscape handler functionality. A local attacker can send a specially crafted D3DKMTEscape request, trigger out-of-bounds read error and cause a denial of service condition on the system.

Remediation

Install update from vendor's website.

References

• https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1119
• https://www.amd.com/en/corporate/product-security