PT-2018-18412 · Hwinfo · Hwinfo

Published 2018-05-10 · Updated 2018-06-13 · CVE-2018-8060

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: HWiNFO AMD64 Kernel driver version 8.98 and lower

Description: The issue allows an unprivileged user to send an IOCTL to the device driver. If input and/or output buffer pointers are NULL or if these buffers' data are invalid, a NULL/invalid pointer access occurs, resulting in a Windows kernel panic, also known as a Blue Screen. This issue affects IOCTLs higher than 0x85FE2600 with the HWiNFO32 symbolic device name.

Recommendations: For HWiNFO AMD64 Kernel driver version 8.98 and lower, update to a version higher than 8.98 to resolve the issue. As a temporary workaround, consider restricting access to the IOCTLs higher than 0x85FE2600 to minimize the risk of exploitation.

Exploit

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2018-8060

Affected Products

Hwinfo

References · 3

• 🔥 https://github.com/otavioarj/SIOCtl · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-8060 · Security Note
• https://osv.dev/vulnerability/CVE-2018-8060 · Vendor Advisory