CVE-2020-12138 json
AMD ATI atillk64.sys 5.11.9.0 allows low-privileged users to interact directly with physical memory by calling one of several driver routin…
published 2020-04-27 6 y ago modified 2026-06-17 4 mo ago also EUVD-2020-4453
- cvss
- 8.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 3.3%
- EPSS 3.3% chance of exploitation in 30 days, percentile 88%
- public exploits
- 0
- none known
Summary
AMD ATI atillk64.sys 5.11.9.0 allows low-privileged users to interact directly with physical memory by calling one of several driver routines that map physical memory into the virtual address space of the calling process. This could enable low-privileged users to achieve NT AUTHORITY\SYSTEM privileges via a DeviceIoControl call associated with MmMapIoSpace, IoAllocateMdl, MmBuildMdlForNonPagedPool, or MmMapLockedPages.
Exploit prediction
3.32% chance of exploitation in the next 30 days, higher than 88% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- h0mbre.github.io https://h0mbre.github.io/atillk64_exploit/ referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 9.0 | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Classification
- Weakness
-
- CWE-862 Missing Authorization
References
-
h0mbre.github.io
/atillk64_exploit/
exploit, third-party-advisory
-
eclypsium.com
/2019/11/12/mother-of-all-drivers/
third-party-advisory
Sources
- CVE List CVE-2020-12138
- NVD CVE-2020-12138
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.