Denial of Service and Privilege Escalation in Asus Aura Sync Software
CVE-2019-17603

7.8HIGH

Key Information:

Vendor
Asus
Status
Aura Sync
Vendor
CVE Published:
2 June 2020

Summary

The Asus Aura Sync software version 1.07.71 contains a vulnerability within the Ene.sys driver that fails to adequately validate input for specific IOCTL commands. This oversight allows local users to exploit the system, resulting in potential denial of service or the ability to escalate privileges. By crafting specific kernel addresses, attackers can induce memory corruption, leading to system crashes or unauthorized access.

References

https://zer0-day.pw/2020-06/asus-aura-sync-stack-based-bu...
x_refsource_MISC
http://packetstormsecurity.com/files/158221/ASUS-Aura-Syn...
x_refsource_MISC

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.