AMD pranešė apie savo programinės įrangos saugumo spragas ir pataisymus

AMD pranešė apie tris jų programinės įrangos saugumo pažeidimus, iš kurių dvi saugumo spragos jau ištaisytos, o trečiosios pataisymo sulauksime 2021 metų pradžioje.

Saugumo pažeidžiamumas, kuris yra dar nepataisytas, rastas vaizdo plokščių tvarkyklėse, jis vadinamas „CreateAllocation“. Ši saugumo spraga gali sukelti mėlyną mirties ekraną (BSOD), bet ilgalaikės įtakos sistemai neturi. Kaip minėjome, pataisymas šiai problemai bus išleistas 2021 metų pradžioje.

Dar viena saugumo spraga AMD grafikos tvarkyklėse pavadinta „EscapeHandler“. Ji irgi gali sukelti mėlyna mirties ekraną, bet pataisymas jau išleistas su paskutiniu tvarkyklių leidimu.

Trečioji saugumo skylė rasta „Ryzen Master“ programinėje įrangoje. Ji leidžia patvirtintiems naudotojams pasiekti tam tikras sistemos privilegijas. AMD šia saugumo skylę jau ištaisė su „Ryzen Master 2.2.0.1543“ versija.

CreateAllocation (CVE-2020-12911)

10/7/2020

Our ecosystem collaborator Cisco Talos has published a new potential vulnerability in AMD graphics drivers, which may result in a blue screen. AMD believes that confidential information and long-term system functionality are not impacted, and that the user can resolve the issue by restarting the computer. AMD plans to issue updated graphics drivers to address the issue in the first quarter of 2021.

The research finds that a specially crafted D3DKMTCreateAllocation API request can cause an out-of-bounds read and denial of service (BSOD). This vulnerability can be triggered from non-privileged accounts.

We thank the researchers for their ongoing collaboration and coordinated disclosure.

AMD Ryzen Master™ Driver Vulnerability (CVE-2020-12928)

10/13/2020

A researcher has discovered a potential security vulnerability impacting AMD Ryzen™ Master that may allow authenticated users to elevate from user to system privileges. AMD has released a mitigation in AMD Ryzen Master 2.2.0.1543. AMD believes that the attack must come from a non-privileged process already running on the system when the local user runs AMD Ryzen™ Master and that a remote attack has not been demonstrated.

We thank the researcher for the ongoing collaboration and coordinated disclosure.

Escape Handler (CVE-2020-12933)

10/13/2020

Our ecosystem collaborator Cisco Talos has published a new potential vulnerability in AMD graphics drivers, which may result in a blue screen. The issue was addressed in Radeon™ Software Adrenalin 2020 Edition.

AMD believes that confidential information and long-term system functionality are not impacted, and users can resolve the issue by restarting the computer.

A specially crafted D3DKMTEscape request can cause an out-of-bounds read in Windows OS kernel memory area. This vulnerability can be triggered from a non-privileged account.

We thank the researchers for their ongoing collaboration and coordinated disclosure.