SB2018121908 - Privilege escalation in Asus Aura Sync

Description

This security bulletin contains information about 3 vulnerabilities.

1) Privilege escalation (CVE-ID: CVE-2018-18537)

CWE-ID: CWE-782 - Exposed IOCTL with Insufficient Access Control

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Clear

The vulnerability allows a local unauthenticated attacker to gain elevated privileges on the target device.

The weakness exists due to a path in the processing of IOCTL_GLCKIO_READPORT (0x80102050) on GLCKIo. A local attacker can write arbitrary DWORD to an arbitrary address and gain elevated privileges.

2) Privilege escalation (CVE-ID: CVE-2018-18536)

CWE-ID: CWE-782 - Exposed IOCTL with Insufficient Access Control

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Green

The vulnerability allows a local unauthenticated attacker to gain elevated privileges on the target device.

The weakness exists due to both GLCKIo and Asusgio expose a functionality to read/write data from/to IO ports. A local attacker can execute arbitrary code with elevated privileges.

3) Privilege escalation (CVE-ID: CVE-2018-18535)

CWE-ID: CWE-782 - Exposed IOCTL with Insufficient Access Control

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Green

The vulnerability allows a local unauthenticated attacker to gain elevated privileges on the target device.

The weakness exists due to Asusgio exposes a functionality to read and write Machine Specific Registers (MSRs). A local attacker can execute arbitrary ring-0 code with elevated privileges.

Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References

• https://www.secureauth.com/labs/advisories/asus-drivers-elevation-privilege-vulnerabilities