SB2024041062 - Multiple vulnerabilities in Microsoft Windows rndismp6.sys

Description

This security bulletin contains information about 2 vulnerabilities.

1) Untrusted Pointer Dereference (CVE-ID: CVE-2024-26252)

CWE-ID: CWE-822 - Untrusted Pointer Dereference

CVSSv4: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to execute arbitrar code o nthe system.

The vulnerability exists due to untrusted pointer dereference in Windows rndismp6.sys. An attacker with physical access can execute arbitrary code on the target system.

2) Input validation error (CVE-ID: CVE-2024-26253)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to execute arbitrary code on the system.

The vulnerability exists due to insufficient validation of user-supplied input in Windows rndismp6.sys. An attacker with physical access can pass specially crafted input to the application and execute arbitrary code on the target system.

Remediation

Install update from vendor's website.

References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-26252
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-26253