CVE-2018-10709

Опубликовано: 30 окт. 2018

Источник: nvd

CVSS3: 7.8

CVSS2: 4.6

EPSS Низкий

Описание

The AsrDrv101.sys and AsrDrv102.sys low-level drivers in ASRock RGBLED before v1.0.35.1, A-Tuning before v3.0.210, F-Stream before v3.0.210, and RestartToUEFI before v1.0.6.2 expose functionality to read and write CR register values. This could be leveraged in a number of ways to ultimately run code with elevated privileges.

Ссылки

https://www.exploit-db.com/exploits/45716/
Exploit
Third Party Advisory
VDB Entry
https://www.secureauth.com/labs/advisories/asrock-drivers-elevation-privilege-vulnerabilities
Exploit
Third Party Advisory
https://www.exploit-db.com/exploits/45716/
Exploit
Third Party Advisory
VDB Entry
https://www.secureauth.com/labs/advisories/asrock-drivers-elevation-privilege-vulnerabilities
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:asrock:a-tuning:*:*:*:*:*:*:*:*

Версия до 3.0.210 (исключая)

cpe:2.3:a:asrock:f-stream:*:*:*:*:*:*:*:*

Версия до 3.0.210 (исключая)

cpe:2.3:a:asrock:restart_to_uefi:*:*:*:*:*:*:*:*

Версия до 1.0.6.2 (исключая)

cpe:2.3:a:asrock:rgbled:*:*:*:*:*:*:*:*

Версия до 1.0.35.1 (исключая)

EPSS

Процентиль: 45%

0.00224

Низкий

7.8 High

CVSS3

4.6 Medium

CVSS2

Дефекты

CWE-732

Связанные уязвимости

GHSA-v8wr-25mj-7jf2