PT-2017-13980 · Cpuid · Cpu-Z

Published 2017-10-16 · Updated 2017-11-07 · CVE-2017-15303

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CPUID CPU-Z versions prior to 1.43

Description The issue allows for an arbitrary memory write, resulting in elevation of privileges. This can occur when any program running on the local machine issues an ioctl call to the kernel-mode driver while CPU-Z is running. For example, this can be done through the 0x9C402430 ioctl call to drivers such as cpuz141 x64.sys.

Recommendations For versions prior to 1.43, update to version 1.43 or later to resolve the issue. As a temporary workaround, consider restricting access to the kernel-mode driver to minimize the risk of exploitation.

Exploit

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

BDU:2025-03103

CVE-2017-15303

Affected Products

Cpu-Z

References · 9

• 🔥 https://github.com/hfiref0x/Stryker · Exploit
• 🔥 https://github.com/dothanthitiendiettiende/PoCs-1/blob/master/CVE-2017-15303/README.md · Exploit
• 🔥❌ https://github.com/akayn/Bugs/blob/master/CPUID/CVE-2017-15303/README.md · Exploit, Deleted
• https://bdu.fstec.ru/vul/2025-03103 · Security Note
• https://osv.dev/vulnerability/CVE-2017-15303 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-15303 · Security Note
• https://4pda.to/forum/index.php?showtopic=472281&st=540 · Note
• https://vuldb.com/?id.107871 · Note
• https://4pda.to/forum/index.php?showtopic=472281&st=540 · Note