Buffer Overflow in NoMachine Enterprise Client Allows Local Code Execution
CVE-2021-42983

8.8HIGH

Key Information:

Vendor

Nomachine

Status
Enterprise Client
Vendor
CVE Published:
7 December 2021

What is CVE-2021-42983?

The NoMachine Enterprise Client is subject to a buffer overflow vulnerability due to a flaw in the IOCTL Handler 0x22001B. This issue affects versions of the software that are above 4.0.346 and below 7.7.4, allowing local attackers to exploit this vulnerability to execute arbitrary code in kernel mode. Additionally, the vulnerability can lead to denial of service conditions, which may result in memory corruption and crashing of the operating system.

References

https://www.sentinelone.com/labs/usb-over-ethernet-multip...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.