Vulnerabilities > CVE-2022-44898 - Out-of-bounds Write vulnerability in Asus Aura Sync 1.07.71/1.07.79
Attack vector
LOCAL Attack complexity
LOW Privileges required
LOW Confidentiality impact
HIGH Integrity impact
HIGH Availability impact
HIGH Summary
The MsIo64.sys component in Asus Aura Sync through v1.07.79 does not properly validate input to IOCTL 0x80102040, 0x80102044, 0x80102050, and 0x80102054, allowing attackers to trigger a memory corruption and cause a Denial of Service (DoS) or escalate privileges via crafted IOCTL requests.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 3 |
Common Weakness Enumeration (CWE)
References
- https://heegong.github.io/posts/ASUS-AuraSync-Kernel-Stack-Based-Buffer-Overflow-Local-Privilege-Escalation/
- https://www.asus.com/campaign/aura/us/download.php
- https://www.asus.com/content/ASUS-Product-Security-Advisory/
- http://packetstormsecurity.com/files/174447/MsIo64-LOLDriver-Memory-Corruption.html