CVE-2020-17382

The MSI AmbientLink MsIo64 driver 1.0.0.8 has a Buffer Overflow (0x80102040, 0x80102044, 0x80102050,and 0x80102054).

Recent assessments:

bwatters-r7 at September 09, 2020 6:09pm UTC reported:

This is a vulnerability in the MSI AmbientLink Version 1.0.0.8. The vulnerability allows a regular user access to a Windows device created by the msio driver provided for the MSI Ambientlink system.
The software device is vulnerable to a buffer overflow attack because it assumes that the received buffer will always be less than 48 bytes, apparently, even when longer lengths are specified by the IOCTL request.
Realistically, as this software runs LED lights on MSI gaming motherboards, it is unlikely to pose a large threat to corporate environments and instead, poses a larger threat to home users or individually-managed PCs, making the patching process significantly easier. I imagine it is also possible to simply remove the software temporarily.
See <https://www.coresecurity.com/core-labs/advisories/msi-ambient-link-multiple-vulnerabilities&gt; for a more in-depth analysis and PoC code.

gwillcox-r7 at September 24, 2020 5:14pm UTC reported:

This is a vulnerability in the MSI AmbientLink Version 1.0.0.8. The vulnerability allows a regular user access to a Windows device created by the msio driver provided for the MSI Ambientlink system.
The software device is vulnerable to a buffer overflow attack because it assumes that the received buffer will always be less than 48 bytes, apparently, even when longer lengths are specified by the IOCTL request.
Realistically, as this software runs LED lights on MSI gaming motherboards, it is unlikely to pose a large threat to corporate environments and instead, poses a larger threat to home users or individually-managed PCs, making the patching process significantly easier. I imagine it is also possible to simply remove the software temporarily.
See <https://www.coresecurity.com/core-labs/advisories/msi-ambient-link-multiple-vulnerabilities&gt; for a more in-depth analysis and PoC code.

Assessed Attacker Value: 2
Assessed Attacker Value: 2Assessed Attacker Value: 4