CVE-2020-12138

AMD ATI atillk64.sys 5.11.9.0 allows low-privileged users to interact directly with physical memory by calling one of several driver routines that map physical memory into the virtual address space of the calling process. This could enable low-privileged users to achieve NT AUTHORITY\SYSTEM privileges via a DeviceIoControl call associated with MmMapIoSpace, IoAllocateMdl, MmBuildMdlForNonPagedPool, or MmMapLockedPages.

• CWE-862

• https://eclypsium.com/2019/11/12/mother-of-all-drivers/Third Party Advisory
• https://h0mbre.github.io/atillk64_exploit/Exploit, Third Party Advisory
• https://eclypsium.com/2019/11/12/mother-of-all-drivers/Third Party Advisory
• https://h0mbre.github.io/atillk64_exploit/Exploit, Third Party Advisory

Published

Apr 27, 2020

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-12131The AirDisk Pro app 5.5.3 for iOS allows XSS via the devicen…6.1
• CVE-2020-12132Fifthplay S.A.M.I before 2019.3_HP2 allows unauthenticated s…6.1
• CVE-2020-12133The Apros Evolution, ConsciusMap, and Furukawa provisioning …9.8
• CVE-2020-12134Nanometrics Centaur through 4.3.23 and TitanSMA through 4.2.…9.8
• CVE-2020-12135bson before 0.8 incorrectly uses int rather than size_t for …5.5
• CVE-2020-12137GNU Mailman 2.x before 2.1.30 uses the .obj extension for sc…6.1
• CVE-2020-1214A remote code execution vulnerability exists in the way that…7.5
• CVE-2020-12140A buffer overflow in os/net/mac/ble/ble-l2cap.c in the BLE s…8.8
• CVE-2020-12141An out-of-bounds read in the SNMP stack in Contiki-NG 4.4 an…9.1
• CVE-2020-121421. IPSec UDP key material can be retrieved from machine-to-m…4.9
• CVE-2020-12143The certificate used to identify Orchestrator to EdgeConnect…4.9
• CVE-2020-12144The certificate used to identify the Silver Peak Cloud Porta…4.9