Privilege Escalation Vulnerability in ASRock Drivers Affecting Multiple Versions
CVE-2018-10710

7.1HIGH

Key Information:

Vendor

Asrock

Status
F-stream
A-tuning
Restart To Uefi
Rgbled
Vendor
CVE Published:
30 October 2018

What is CVE-2018-10710?

The ASRock drivers, specifically AsrDrv101.sys and AsrDrv102.sys, contain a vulnerability that allows local attackers to read and write arbitrary physical memory. This misconfiguration can be exploited by attackers to elevate their privileges without appropriate authorization. The affected versions include RGBLED prior to v1.0.35.1, A-Tuning and F-Stream before v3.0.210, and RestartToUEFI before v1.0.6.2. Users are advised to upgrade to the latest versions to protect against potential exploits.

References

https://www.secureauth.com/labs/advisories/asrock-drivers...
x_refsource_MISC
https://www.exploit-db.com/exploits/45716/
exploitx_refsource_EXPLOIT-DB

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2018-10710 : Privilege Escalation Vulnerability in ASRock Drivers Affecting Multiple Versions