PT-2023-2908 · Flexihub · Flexihub

Zeze7W · Publicado 2023-05-24 · Atualizado 2024-05-17 · CVE-2023-2872

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions FlexiHub version 5.5.14691.0

Description A problematic vulnerability has been found in the library fusbhub.sys of the component IoControlCode Handler, affecting the function 0x220088. This leads to a null pointer dereference. The attack must be approached locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Recommendations For FlexiHub version 5.5.14691.0, as a temporary workaround, consider disabling the function 0x220088 in the library fusbhub.sys until a patch is available. Restrict access to the IoControlCode Handler component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

NULL Pointer Dereference

Enumeração de Fraquezas

CWE-476

Identificadores relacionados

BDU:2023-02863

CVE-2023-2872

Produtos afetados

Flexihub

Referências · 9

• 🔥 https://github.com/zeze-zeze/WindowsKernelVuln/blob/master/CVE-2023-2872 · Exploit
• 🔥 https://drive.google.com/file/d/1h-7fnmb31bkEW4FoLNDlneftDqS4TQHT/view?usp=sharing · Exploit
• https://osv.dev/vulnerability/CVE-2023-2872 · Aviso do Fabricante
• https://vuldb.com/?ctiid.229851 · Nota
• https://t.me/cibsecurity/64707 · Publicação no Telegram
• https://bdu.fstec.ru/vul/2023-02863 · Nota de Segurança
• https://vuldb.com/?id.229851 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-2872 · Nota de Segurança
• https://t.me/cvenotify/51079 · Publicação no Telegram