ASUS, GIGABYTE Drivers Contain Code Execution Vulnerabilities - PoCs Galore

guest · Dec 18, 2018

ASUS, GIGABYTE Drivers Contain Code Execution Vulnerabilities - PoCs Galore
December 18, 2018
https://www.bleepingcomputer.com/ne...n-code-execution-vulnerabilities-pocs-galore/

Four drivers from ASUS and GIGABYTE come with several vulnerabilities that can be leveraged by an attacker to gain higher permissions on the system and to execute arbitrary code.

Two of the vulnerable drivers are installed by the Aura Sync software (v1.07.22 and earlier) from ASUS and the flaws they carry can be exploited for local code execution.

The drivers from GIGABYTE are distributed with motherboards and graphics cards of the same brand as well as from the company's subsidiary, AORUS.
The vulnerabilities lead to privilege escalation via software like the GIGABYTE App Center (v1.05.21 and below), AORUS Graphics Engine (v1.33 and below), the XTREME Engine utility (v1.25 and earlier), and OC Guru II (v2.08). [...]
Click to expand...

Three bugs found in ASUS' GLCKIo and Asusgio drivers
[...] Diego Juarez, exploit writer at SecureAuth discovered and studies these flaws; the security company disclosed them responsibly but after releasing two new versions for Aura Sync, ASUS still left two of the vulnerabilities unaddressed, the researchers say in an advisory published today.

GIGABYTE drivers allow interaction with non-privileged processes
[...] disclosure timeline in the advisory from SecureAuth [...]
GIGABYTE communication also unfruitful
The last answer received from the hardware company dismissed the vulnerabilities completely, as "Gigabyte responded that, according to its PM and engineers, its products are not affected by the reported vulnerabilities," SecureAuth says.
Click to expand...

Log in or Sign up

ASUS, GIGABYTE Drivers Contain Code Execution Vulnerabilities - PoCs Galore

guest Guest

Log in or Sign up

ASUS, GIGABYTE Drivers Contain Code Execution Vulnerabilities - PoCs Galore

guest Guest

Useful Searches