Integer Overflow Vulnerability in NoMachine Enterprise Desktop by NoMachine
CVE-2021-42977

8.8HIGH

Key Information:

Vendor

Nomachine

Status
Enterprise Desktop
Vendor
CVE Published:
7 December 2021

What is CVE-2021-42977?

The NoMachine Enterprise Desktop suffers from an Integer Overflow vulnerability in the IOCTL Handler 0x22001B, which affects versions above 4.0.346 and below 7.7.4. This weakness allows local attackers to exploit specially crafted I/O Request Packets to execute arbitrary code in kernel mode, potentially leading to memory corruption and causing a denial of service through OS crashes.

References

https://www.sentinelone.com/labs/usb-over-ethernet-multip...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.