Headline
CVE-2022-42455: Vulnerability-Disclosures/MNDT-2023-0003.md at master · mandiant/Vulnerability-Disclosures
ASUS EC Tool driver (aka d.sys) 1beb15c90dcf7a5234ed077833a0a3e900969b60be1d04fcebce0a9f8994bdbb, as signed by ASUS and shipped with multiple ASUS software products, contains multiple IOCTL handlers that provide raw read and write access to port I/O and MSRs via unprivileged IOCTL calls. Local users can gain privileges.
MNDT-2023-0003****Description
Multiple vulnerabilities exist in ASUS driver file Driver7.sys (1beb15c90dcf7a5234ed077833a0a3e900969b60be1d04fcebce0a9f8994bdbb) ioctl handler in Armoury Crate Throttle Gear Merge Module versions 5.3.4.0 and earlier.
Impact
High - Exploiting the vulnerability will give a local attacker SYSTEM level privileges.
Exploitability
Medium - The driver is only functional on an ASUS system (checks SMBIOS for ASUS strings).
CVE Reference
CVE-2022-42455
Common Vulnerability Scoring System
Base Score: 7.8 - Vector: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Technical Details
IOCTL 0x9C40E414 exposes arbitrary MSR read and write capability.
Resolution
The issue was fixed in Armoury Crate Throttle Gear Merge Module version 5.3.4.1 as per ASUS.
Discovery Credits
- Dan Kelly, Mandiant
- Sam Kim, Mandiant
- Dhanesh Kizhakkinan, Mandiant
Disclosure Timeline
- 04-Oct-2022 - Issue reported to Asus
- 11-Oct-2022 - Asus replied with updated software information
References
- Mitre CVE-2022-42455