Lucene search

[email protected]CVE-2018-10712

HistoryOct 30, 2018 - 6:29 p.m.

CVE-2018-10712

2018-10-3018:29:00

CWE-732

[email protected]

web.nvd.nist.gov

asrock rgbled

a-tuning

f-stream

restarttouefi

driver vulnerability

elevated privileges

cve-2018-10712

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.1 High

AI Score

Confidence

High

7.2 High

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

0.0005 Low

EPSS

Percentile

18.0%

JSON

The AsrDrv101.sys and AsrDrv102.sys low-level drivers in ASRock RGBLED before v1.0.35.1, A-Tuning before v3.0.210, F-Stream before v3.0.210, and RestartToUEFI before v1.0.6.2 expose functionality to read/write data from/to IO ports. This could be leveraged in a number of ways to ultimately run code with elevated privileges.

Affected configurations

NVD

Node

asrocka-tuningRange<3.0.210

asrockf-streamRange<3.0.210

asrockrestart_to_uefiRange<1.0.6.2

asrockrgbledRange<1.0.35.1

CPENameOperatorVersion
asrock:a-tuningasrock a-tuninglt3.0.210
asrock:f-streamasrock f-streamlt3.0.210
asrock:restart_to_uefiasrock restart to uefilt1.0.6.2
asrock:rgbledasrock rgbledlt1.0.35.1

CPE	Name	Operator	Version
asrock:a-tuning	asrock a-tuning	lt	3.0.210
asrock:f-stream	asrock f-stream	lt	3.0.210
asrock:restart_to_uefi	asrock restart to uefi	lt	1.0.6.2
asrock:rgbled	asrock rgbled	lt	1.0.35.1