Vulnerabilities > CVE-2017-7293 - Deserialization of Untrusted Data vulnerability in Dolby Audio X2 and Dolby Audio X3
Attack vector
LOCAL Attack complexity
LOW Privileges required
NONE Confidentiality impact
COMPLETE Integrity impact
COMPLETE Availability impact
COMPLETE Summary
The Dolby DAX2 and DAX3 API services are vulnerable to a privilege escalation vulnerability that allows a normal user to get arbitrary system privileges, because these services have .NET code for DCOM. This affects Dolby Audio X2 (DAX2) 1.0, 1.0.1, 1.1, 1.1.1, 1.2, 1.3, 1.3.1, 1.3.2, 1.4, 1.4.1, 1.4.2, 1.4.3, and 1.4.4 and Dolby Audio X3 (DAX3) 1.0 and 1.1. An example affected driver is Realtek Audio Driver 6.0.1.7898 on a Lenovo P50.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Exploit-Db
| description | Windows 10 Realtek Audio Driver 6.0.1.7898 - Dolby Audio X2 Service Privilege Escalation. CVE-2017-7293. Local exploit for Windows platform |
| file | exploits/windows/local/41933.txt |
| id | EDB-ID:41933 |
| last seen | 2017-04-25 |
| modified | 2017-04-25 |
| platform | windows |
| port | |
| published | 2017-04-25 |
| reporter | Exploit-DB |
| source | https://www.exploit-db.com/download/41933/ |
| title | Windows 10 Realtek Audio Driver 6.0.1.7898 - Dolby Audio X2 Service Privilege Escalation |
| type | local |
Seebug
| bulletinFamily | exploit |
| description | Windows: Dolby Audio X2 Service Elevation of Privilege Platform: Windows 10 + Realtek Audio Driver version 6.0.1.7898 (on a Lenovo P50). Version of the service binary 0.7.2.61 built on 7/18/2016. Class: Elevation of Privilege #### Summary: The DAX2API service installed as part of the Realtek Audio Driver on Windows 10 is vulnerable to a privilege escalation vulnerability which allows a normal user to get arbitrary system privileges. #### Description: The DAX2API service is a DCOM service written in .NET running at system privileges. The use of .NET for DCOM is inherently unsafe and should not be used. There’s public exploit code to elevate privileges on arbitrary services available at https://github.com/tyranid/ExploitDotNetDCOM. Microsoft recommends moving from using DCOM to WCF for .NET services of different privilege levels. See https://blogs.technet.microsoft.com/srd/2014/10/14/more-details-about-cve-2014-4073-elevation-of-privilege-vulnerability/ for more information. Proof of Concept: To demonstrate the vulnerability download the project https://github.com/tyranid/ExploitDotNetDCOM and compile using Visual Studio. The executable to use is ExploitDotNetDCOMSerialization.exe. 1) From a command prompt run the command “ExploitDotNetDCOMSerialization.exe 6A28A945-790C-4B68-B0F4-34EEB1626EE3 notepad” 2) Check the currently running processes for the privileged copy of notepad, Expected Result: No privilege escalation occurs. Observed Result: An instance of notepad is running at system privileges. |
| id | SSV:93058 |
| last seen | 2017-11-19 |
| modified | 2017-04-27 |
| published | 2017-04-27 |
| reporter | Root |
| title | Windows: Dolby Audio X2 Service EoP (CVE-2017-7293) |