PT-2019-18994 · Microsoft · Lha.Sys

Jackson T · Published 2019-02-18 · Updated 2023-04-16 · CVE-2019-8372

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LHA.sys driver versions prior to 1.1.1811.2101

Description The issue allows low-privileged users to read and write arbitrary physical memory, potentially elevating system privileges. This is possible due to the device object having an associated symbolic link and an open DACL, which can be exploited via specially crafted IOCTL requests.

Recommendations For versions prior to 1.1.1811.2101, update the LHA.sys driver to version 1.1.1811.2101 or later to resolve the issue. As a temporary workaround, consider restricting access to the LHA.sys driver to minimize the risk of exploitation.

Exploit

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2019-8372

Affected Products

Lha.Sys

References · 6

• 🔥 http://jackson-t.ca/lg-driver-lpe.html · Exploit
• https://lgsecurity.lge.com/security_updates.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-8372 · Security Note
• https://osv.dev/vulnerability/CVE-2019-8372 · Vendor Advisory
• https://twitter.com/Jackson_T/status/1097353402034475009 · Note
• https://t.me/ckure/12330 · Telegram Post