CVE-2019-5049
📋 TL;DR
This vulnerability allows an attacker to execute arbitrary code on systems with vulnerable AMD graphics drivers by exploiting an out-of-bounds memory write in the ATIDXX64.DLL driver. It affects VMware environments where a guest VM can compromise the host system. Users with AMD Radeon drivers versions 25.20.15031.5004 and 25.20.15031.9002 are vulnerable.
💻 Affected Systems
- AMD Radeon Graphics Drivers
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full host compromise in VMware environments allowing attacker to escape guest VM and gain complete control over the host system.
Likely Case
Local privilege escalation on affected systems, potentially leading to system compromise.
If Mitigated
Limited impact if systems are isolated, patched, or have vulnerable drivers removed.
🎯 Exploit Status
Exploit requires local access or ability to execute shader files. VMware escape capability makes this particularly dangerous in virtualized environments.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Later versions of AMD Radeon drivers
Vendor Advisory: https://www.amd.com/en/resources/product-security/bulletin/amd-sb-1000.html
Restart Required: Yes
Instructions:
1. Download latest AMD Radeon drivers from AMD website. 2. Uninstall current AMD drivers. 3. Install updated drivers. 4. Restart system.
🔧 Temporary Workarounds
Disable vulnerable driver
windowsRemove or disable the ATIDXX64.DLL driver if AMD graphics are not essential
sc stop amdkmdag
sc config amdkmdag start= disabled
VMware isolation
allIsolate VMware guest VMs from hosts with vulnerable drivers
🧯 If You Can't Patch
- Segment VMware environments to limit blast radius if guest VM is compromised
- Implement strict access controls and monitoring for systems with vulnerable drivers
🔍 How to Verify
Check if Vulnerable:
Check driver version of ATIDXX64.DLL in C:\Windows\System32\DriverStore\FileRepositoryCheck Version:
powershell Get-Item "C:\Windows\System32\DriverStore\FileRepository\*\atidxx64.dll" | Select-Object VersionInfoVerify Fix Applied:
Verify ATIDXX64.DLL version is newer than 25.20.15031.9002📡 Detection & Monitoring
Log Indicators:
- Unexpected process crashes related to AMD drivers
- Suspicious shader file execution
Network Indicators:
- Unusual VM-to-host communication patterns in VMware environments
SIEM Query:
EventID=1000 AND SourceName='Application Error' AND Message LIKE '%atidxx64.dll%'