CVE-2020-6102
📋 TL;DR
This vulnerability allows remote code execution through specially crafted shader files in AMD Radeon DirectX 11 drivers. Attackers can exploit this from Hyper-V guests via RemoteFX or potentially through web browsers using WebGL/WebAssembly. Affected systems include Windows hosts with vulnerable AMD graphics drivers and Hyper-V RemoteFX enabled.
💻 Affected Systems
- AMD Radeon DirectX 11 Driver
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full compromise of Hyper-V host from guest VM leading to complete host takeover and lateral movement across the network.
Likely Case
Privilege escalation from Hyper-V guest to host, allowing attacker to escape virtualization and access host resources.
If Mitigated
Limited to guest VM compromise if RemoteFX is disabled and web-based vectors are blocked.
🎯 Exploit Status
Exploitation requires attacker to deliver malicious shader file to target system, either through guest VM compromise or potentially via web vectors.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: AMD driver updates after June 2020
Vendor Advisory: https://www.amd.com/en/resources/product-security/bulletin/amd-sb-1000.html
Restart Required: Yes
Instructions:
1. Update AMD Radeon graphics drivers to latest version. 2. Apply Windows updates for Hyper-V/RemoteFX patches. 3. Restart system after updates.
🔧 Temporary Workarounds
Disable Hyper-V RemoteFX
windowsPrevents guest-to-host exploitation by disabling vulnerable RemoteFX feature
Disable-VMRemoteFXPhysicalVideoAdapter -VMName * (PowerShell)
Remove RemoteFX 3D Video Adapter from VM settings
Block WebGL in browsers
windowsMitigates theoretical web-based exploitation vectors
Browser settings: disable WebGL and WebAssembly
Group Policy: Computer Configuration > Administrative Templates > Windows Components > Microsoft Edge > Allow WebGL
🧯 If You Can't Patch
- Disable Hyper-V RemoteFX on all hosts and remove from VMs
- Isolate Hyper-V hosts from critical networks and implement strict network segmentation
🔍 How to Verify
Check if Vulnerable:
Check atidxx64.dll version in System32 folder: right-click file > Properties > Details tabCheck Version:
powershell Get-Item C:\Windows\System32\atidxx64.dll | Select-Object VersionInfoVerify Fix Applied:
Verify driver version is newer than 26.20.15019.19000 and check Windows Update history for Hyper-V/RemoteFX patches📡 Detection & Monitoring
Log Indicators:
- Unusual process creation from rdvgm.exe
- Suspicious shader file loading in graphics driver logs
- Hyper-V guest escape attempts
Network Indicators:
- Unexpected network traffic from Hyper-V hosts
- Anomalous WebGL/WebAssembly requests to internal systems
SIEM Query:
Process Creation where Parent Process Name contains 'rdvgm.exe' OR Image Loaded contains 'atidxx64.dll' AND Command Line contains suspicious shader parameters