ASUS patches ROG Armoury Crate app after researcher spots all-too-common flaw

guest · Sep 29, 2021

ASUS patches ROG Armoury Crate app after researcher spots all-too-common flaw
It tries to load a file from a location any old user can write to
September 28, 2021
https://www.theregister.com/2021/09/28/asus_rog_armoury_crate_security_flaw_patched/

A flaw in ASUS's ROG Armoury Crate hardware management app could have allowed low-privileged users to execute code as administrator.

The now-patched privilege escalation vulnerability was uncovered by "Federico" from Italian hacker collective APTortellini.
Click to expand...

Federico discovered the vuln after taking a close look at ROG Armoury Crate, finding a DLL hijacking vuln that allowed ordinary users to execute code with SYSTEM privileges after pasting a crafted file into a directory used by the app.

Analysing boot logs from Process Monitor allowed Federico to see that Armoury Crate version 4.2.8 was calling a DLL file from a folder inside C:\ProgramData\, a folder which ordinary users on a Windows 10 PC can write to without requiring an admin password or any other escalated privileges.
Click to expand...

Tracked as CVE-2021-40981, the vuln has not yet received a public CVE score.

"This kind of software is usually poorly designed from a security perspective – not shaming ASUS here, it's just a matter of fact as gaming software is usually not designed with security in mind, it has to be flashy and eye-catching – so I ended up focusing my effort on this particular piece of software," commented Federico.

DLL-bound privesc vulns of the sort found by Federico are relatively common.
Click to expand...

Log in or Sign up

ASUS patches ROG Armoury Crate app after researcher spots all-too-common flaw

guest Guest

Log in or Sign up

ASUS patches ROG Armoury Crate app after researcher spots all-too-common flaw

guest Guest

Useful Searches