PT-2020-11237 · Techpowerup · Gpu-Z

Ryan Warns · Published 2020-03-25 · Updated 2020-04-01 · CVE-2019-7245

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions TechPowerUp GPU-Z versions prior to 2.23.0

Description An issue was discovered in the GPU-Z.sys driver, which exposes a wrmsr instruction via an IOCTL and does not properly filter the Model Specific Register (MSR). This allows arbitrary MSR writes, leading to Ring-0 code execution and escalation of privileges.

Recommendations For versions prior to 2.23.0, update to version 2.23.0 or later to resolve the issue. As a temporary workaround, consider disabling the vulnerable driver until a patch is available. Restrict access to the IOCTL endpoint to minimize the risk of exploitation. Avoid using the wrmsr instruction in the affected driver until the issue is resolved.

Exploit

Fix

Improper Initialization

Weakness Enumeration

CWE-665

Related Identifiers

CVE-2019-7245

Affected Products

Gpu-Z

References · 5

• 🔥 https://github.com/fireeye/Vulnerability-Disclosures/blob/master/FEYE-2019-0002/FEYE-2019-0002.md · Exploit
• https://osv.dev/vulnerability/CVE-2019-7245 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-7245 · Security Note
• https://t.me/cvenotify/2132 · Telegram Post
• https://t.me/cibsecurity/10814 · Telegram Post