Medium severity · published Jun 11, 2021
CVE-2020-12987
A heap information leak/kernel pool address disclosure vulnerability in the AMD Graphics Driver for Windows 10 may lead to KASLR bypass
5.5
CVSS
0.3%
EPSS
No
On KEV
Description
A heap information leak/kernel pool address disclosure vulnerability in the AMD Graphics Driver for Windows 10 may lead to KASLR bypass.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 20% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RP
Radeon Pro Software · Amd
before 21.q1 · source: NVD
RS
Radeon Software · Amd
before 20.7.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-12987
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-12987
www.amd.com
https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1000
More from Radeon Pro Software
7.8
CVE-2021-26392
Insufficient verification of missing size check in 'LoadModule' may lead to an out-of-bounds write potentially allowing an attacker with privileges to gain code execution of the…
7.8
CVE-2021-26391
Insufficient verification of multiple header signatures while loading a Trusted Application (TA) may allow an attacker with privileges to gain code execution in that TA or the…
7.8
CVE-2021-26360
An attacker with local access to the system can make unauthorized modifications of the security configuration of the SOC registers
7.8
CVE-2020-12931
Improper parameters handling in the AMD Secure Processor (ASP) kernel may allow a privileged attacker to elevate their privileges potentially leading to loss of integrity
7.8
CVE-2020-12930
Improper parameters handling in AMD Secure Processor (ASP) drivers may allow a privileged attacker to elevate their privileges potentially leading to loss of integrity