CVE-2017-15302

In CPUID CPU-Z through 1.81, there are improper access rights to a kernel-mode driver (e.g., cpuz143_x64.sys for version 1.43) that can result in information disclosure or elevation of privileges, because of an arbitrary read of any physical address via ioctl 0x9C402604. Any application running on the system (Windows), including sandboxed users, can issue an ioctl to this driver without any validation. Furthermore, the driver can map any physical page on the system and returns the allocated map page address to the user: that results in an information leak and EoP. NOTE: the vendor indicates that the arbitrary read itself is intentional behavior (for ACPI scan functionality); the security issue is the lack of an ACL.

CVSS v3 7.8 HIGH
CVSS v2.0 7.2 HIGH

7.8^/10

CVSS v3 : HIGH

Vector : AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.2^/10

CVSS v2.0 : HIGH

Vector : AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 3.9 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://github.com/akayn/Bugs/blob/master/CPUID/CVE-2017-15302/README.md	Third Party Advisory
https://github.com/akayn/Bugs/blob/master/CPUID/CVE-2017-15302/README.md	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:cpuid:cpu-z:*:*:*:*:*:windows:*:*

History

21 Nov 2024, 03:14

Type	Values Removed	Values Added
References	~~() https://github.com/akayn/Bugs/blob/master/CPUID/CVE-2017-15302/README.md - Third Party Advisory~~	() https://github.com/akayn/Bugs/blob/master/CPUID/CVE-2017-15302/README.md - Third Party Advisory

Information

Published : 2017-10-16 01:29

Updated : 2024-11-21 03:14

NVD link : CVE-2017-15302

Mitre link : CVE-2017-15302

CVE.ORG link : CVE-2017-15302

JSON object : View

Products Affected

cpuid

cpu-z

CWE

NVD-CWE-noinfo

{"id": "CVE-2017-15302", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.2, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2017-10-16T01:29:00.937", "references": [{"url": "https://github.com/akayn/Bugs/blob/master/CPUID/CVE-2017-15302/README.md", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/akayn/Bugs/blob/master/CPUID/CVE-2017-15302/README.md", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "In CPUID CPU-Z through 1.81, there are improper access rights to a kernel-mode driver (e.g., cpuz143_x64.sys for version 1.43) that can result in information disclosure or elevation of privileges, because of an arbitrary read of any physical address via ioctl 0x9C402604. Any application running on the system (Windows), including sandboxed users, can issue an ioctl to this driver without any validation. Furthermore, the driver can map any physical page on the system and returns the allocated map page address to the user: that results in an information leak and EoP. NOTE: the vendor indicates that the arbitrary read itself is intentional behavior (for ACPI scan functionality); the security issue is the lack of an ACL."}, {"lang": "es", "value": "En CPUID CPU-Z hasta la versi\u00f3n 1.81, hay derechos de acceso incorrectos al controlador del modo kernel (ej.: cpuz143_x64.sys para la versi\u00f3n 1.43) que pueden dar como resultado una revelaci\u00f3n de informaci\u00f3n o una elevaci\u00f3n de privilegios, debido a una lectura arbitraria de cualquier direcci\u00f3n f\u00edsica mediante una llamada IOCTL 0x9C402604. Cualquier aplicaci\u00f3n que se ejecute en el sistema (Windows), incluidos los usuarios en sandbox, puede realizar una llamada IOCTL a este controlador sin ninguna validaci\u00f3n. Adem\u00e1s, el controlador puede asignar cualquier p\u00e1gina f\u00edsica en el sistema y devolver al usuario la direcci\u00f3n de la p\u00e1gina de asignaci\u00f3n asignada. Esto desemboca en una revelaci\u00f3n de informaci\u00f3n y una elevaci\u00f3n de privilegios. NOTA: el fabricante indica que la lectura arbitraria en s\u00ed es un comportamiento intencionado (para la funcionalidad de escaneo ACPI). El problema de seguridad es la falta de una lista de control de acceso o ACL."}], "lastModified": "2024-11-21T03:14:25.237", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cpuid:cpu-z:*:*:*:*:*:windows:*:*", "vulnerable": true, "matchCriteriaId": "3862479F-3E2F-444B-A942-C6EBAE876E3D", "versionEndIncluding": "1.81"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}