Privilege Escalation Vulnerability in TechPowerUp GPU-Z Software

CVE-2019-7245

What is CVE-2019-7245?

A privilege escalation vulnerability exists in the GPU-Z driver (GPU-Z.sys) from TechPowerUp prior to version 2.23.0. This flaw arises from the driver's failure to properly filter Model Specific Registers (MSRs) when executing a wrmsr instruction via an IOCTL. This oversight enables an attacker to perform arbitrary write operations to the MSR, potentially leading to Ring-0 code execution. As a result, unauthorized users may gain escalated privileges, allowing them to execute arbitrary code within the most privileged level of the operating system.

References