SB2018121908 - Privilege escalation in Asus Aura Sync

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Privilege escalation (CVE-ID: CVE-2018-18537)

The vulnerability allows a local unauthenticated attacker to gain elevated privileges on the target device.

The weakness exists due to a path in the processing of IOCTL_GLCKIO_READPORT (0x80102050) on GLCKIo. A local attacker can write arbitrary DWORD to an arbitrary address and gain elevated privileges.

2) Privilege escalation (CVE-ID: CVE-2018-18536)

The vulnerability allows a local unauthenticated attacker to gain elevated privileges on the target device.

The weakness exists due to both GLCKIo and Asusgio expose a functionality to read/write data from/to IO ports. A local attacker can execute arbitrary code with elevated privileges.

3) Privilege escalation (CVE-ID: CVE-2018-18535)

The vulnerability allows a local unauthenticated attacker to gain elevated privileges on the target device.

The weakness exists due to Asusgio exposes a functionality to read and write Machine Specific Registers (MSRs). A local attacker can execute arbitrary ring-0 code with elevated privileges.

Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References

• https://www.secureauth.com/labs/advisories/asus-drivers-elevation-privilege-vulnerabilities