ASUS Aura Sync Buffer Overflow Vulnerability

ASUS Aura Sync is a hardware light synchronization plug-in from Asus Taiwan, China. A security vulnerability exists in the Ene.sys file in ASUS Aura Sync 1.07.71 and earlier versions, which originates from the program failing to properly validate input sent to IOCTL 0x80102044, 0x80102050, and...

CVE-2019-17603

Ene.sys in Asus Aura Sync through 1.07.71 does not properly validate input to IOCTL 0x80102044, 0x80102050, and 0x80102054, which allows local users to cause a denial of service system crash or gain privileges via IOCTL requests using crafted kernel addresses that trigger memory corruption...

CVE-2019-17603

Ene.sys in Asus Aura Sync through 1.07.71 does not properly validate input to IOCTL 0x80102044, 0x80102050, and 0x80102054, which allows local users to cause a denial of service system crash or gain privileges via IOCTL requests using crafted kernel addresses that trigger memory corruption...

Memory corruption

Ene.sys in Asus Aura Sync through 1.07.71 does not properly validate input to IOCTL 0x80102044, 0x80102050, and 0x80102054, which allows local users to cause a denial of service system crash or gain privileges via IOCTL requests using crafted kernel addresses that trigger memory corruption...

CVE-2019-17603

Affected software: ASUS Aura Sync (Ene.sys) up to version 1.07.71. Vulnerability: IOCTL handling in Ene.sys does not properly validate input to IOCTL 0x80102044, 0x80102050, and 0x80102054, enabling local users to cause a denial of service (system crash) or gain privileges via crafted kernel addr...

CVE-2019-17603

Ene.sys in Asus Aura Sync through 1.07.71 does not properly validate input to IOCTL 0x80102044, 0x80102050, and 0x80102054, which allows local users to cause a denial of service system crash or gain privileges via IOCTL requests using crafted kernel addresses that trigger memory corruption...

CVE-2018-18537

The GLCKIo low-level driver in ASUS Aura Sync v1.07.22 and earlier exposes a path to write an arbitrary DWORD to an arbitrary address...

CVE-2018-18535

The Asusgio low-level driver in ASUS Aura Sync v1.07.22 and earlier exposes functionality to read and write Machine Specific Registers MSRs. This could be leveraged to execute arbitrary ring-0 code...

CVE-2018-18537

The GLCKIo low-level driver in ASUS Aura Sync v1.07.22 and earlier exposes a path to write an arbitrary DWORD to an arbitrary address...

CVE-2018-18535

The Asusgio low-level driver in ASUS Aura Sync v1.07.22 and earlier exposes functionality to read and write Machine Specific Registers MSRs. This could be leveraged to execute arbitrary ring-0 code...

CVE-2018-18536

The GLCKIo and Asusgio low-level drivers in ASUS Aura Sync v1.07.22 and earlier expose functionality to read/write data from/to IO ports. This could be leveraged in a number of ways to ultimately run code with elevated privileges...

CVE-2018-18536

The GLCKIo and Asusgio low-level drivers in ASUS Aura Sync v1.07.22 and earlier expose functionality to read/write data from/to IO ports. This could be leveraged in a number of ways to ultimately run code with elevated privileges...

Code injection

The Asusgio low-level driver in ASUS Aura Sync v1.07.22 and earlier exposes functionality to read and write Machine Specific Registers MSRs. This could be leveraged to execute arbitrary ring-0 code...

Path traversal

The GLCKIo low-level driver in ASUS Aura Sync v1.07.22 and earlier exposes a path to write an arbitrary DWORD to an arbitrary address...

Code injection

The GLCKIo and Asusgio low-level drivers in ASUS Aura Sync v1.07.22 and earlier expose functionality to read/write data from/to IO ports. This could be leveraged in a number of ways to ultimately run code with elevated privileges...

CVE-2018-18536

The CVE-2018-18536 issue concerns ASUS Aura Sync’s GLCKIo and Asusgio low-level drivers (version 1.07.22 and earlier). The drivers expose functionality to read/write data from/to IO ports, which can be leveraged on a local system to run code with elevated privileges. Documented impact is local co...

CVE-2018-18535

The Asusgio low-level driver in ASUS Aura Sync v1.07.22 and earlier exposes functionality to read and write Machine Specific Registers MSRs. This could be leveraged to execute arbitrary ring-0 code...

CVE-2018-18537

The GLCKIo low-level driver in ASUS Aura Sync v1.07.22 and earlier exposes a path to write an arbitrary DWORD to an arbitrary address...

CVE-2018-18537

CVE-2018-18537 affects the GLCKIo low-level driver in ASUS Aura Sync prior to v1.07.22, where an exposed IOCTL path permits writing an arbitrary DWORD to an arbitrary address due to insufficient access control. This enables local privilege escalation by manipulating kernel memory. Documented impa...

CVE-2018-18535

CVE-2018-18535 affects the Asusgio low-level driver in ASUS Aura Sync versions 1.07.22 and earlier. The driver exposes functionality to read and write Machine Specific Registers (MSRs), which can be leveraged to execute arbitrary ring-0 code via local access. The vulnerability is described as a l...