PT-2020-13060 · Ati · Atillk64.Sys

Jesse Michael + 1 · Published 2020-04-27 · Updated 2025-11-21 · CVE-2020-12138

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions atillk64.sys version 5.11.9.0

Description The issue allows low-privileged users to interact directly with physical memory by calling one of several driver routines that map physical memory into the virtual address space of the calling process. This could enable low-privileged users to achieve NT AUTHORITYSYSTEM privileges via a DeviceIoControl call associated with MmMapIoSpace, IoAllocateMdl, MmBuildMdlForNonPagedPool, or MmMapLockedPages.

Recommendations For atillk64.sys version 5.11.9.0, consider restricting access to the driver routines MmMapIoSpace, IoAllocateMdl, MmBuildMdlForNonPagedPool, and MmMapLockedPages to prevent low-privileged users from achieving NT AUTHORITYSYSTEM privileges. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2020-12138

Affected Products

Atillk64.Sys

References · 7

• 🔥 https://h0mbre.github.io/atillk64_exploit · Exploit
• https://osv.dev/vulnerability/CVE-2020-12138 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-12138 · Security Note
• https://eclypsium.com/2019/11/12/mother-of-all-drivers · Note
• https://twitter.com/magicswordio/status/1991903952493740263 · Twitter Post
• https://t.me/cvenotify/3245 · Telegram Post
• https://twitter.com/magicswordio/status/1991903942993969497 · Twitter Post