PT-2020-11235 · Moo0 · Moo0 System Monitor

Ryan Warns · Published 2020-03-25 · Updated 2020-04-01 · CVE-2019-7240

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Moo0 System Monitor version 1.83

Description An issue was discovered in the WinRing0x64.sys driver, which exposes a wrmsr instruction via IOCTL 0x9C402088 and does not properly filter the Model Specific Register (MSR). This allows arbitrary MSR writes, leading to Ring-0 code execution and escalation of privileges.

Recommendations For Moo0 System Monitor version 1.83, consider disabling the WinRing0x64.sys driver until a patch is available to prevent arbitrary MSR writes. Restrict access to the IOCTL 0x9C402088 to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Initialization

Weakness Enumeration

CWE-665

Related Identifiers

CVE-2019-7240

Affected Products

Moo0 System Monitor

References · 5

• 🔥 https://github.com/fireeye/Vulnerability-Disclosures/blob/master/FEYE-2019-0004/FEYE-2019-0004.md · Exploit
• https://osv.dev/vulnerability/CVE-2019-7240 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-7240 · Security Note
• https://t.me/cibsecurity/10816 · Telegram Post
• https://t.me/cvenotify/2130 · Telegram Post