Integer Overflow Vulnerability in NoMachine Server by NoMachine
CVE-2021-42973

8.8HIGH

Key Information:

Vendor

Nomachine

Status
Server
Vendor
CVE Published:
7 December 2021

What is CVE-2021-42973?

The NoMachine Server is affected by an integer overflow vulnerability in the IOCTL Handler (0x22001B). This issue exists in versions above 4.0.346 and below 7.7.4, enabling local attackers to potentially execute arbitrary code in kernel mode. Additionally, the vulnerability may lead to memory corruption and cause the operating system to crash, resulting in a denial of service. Attackers can exploit this flaw by sending specially crafted I/O Request Packets, making it crucial for users to address this vulnerability promptly.

References

https://www.sentinelone.com/labs/usb-over-ethernet-multip...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.