PT-2022-27329 · Asus · Asus Aura Sync

Heechan Kim + 1 · Published 2022-12-14 · Updated 2023-09-02 · CVE-2022-44898

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Asus Aura Sync versions through v1.07.79

Description The issue concerns the MsIo64.sys component, which does not properly validate input to certain IOCTL requests, specifically 0x80102040, 0x80102044, 0x80102050, and 0x80102054. This allows attackers to trigger memory corruption, potentially causing a Denial of Service (DoS) or escalating privileges via crafted IOCTL requests.

Recommendations For Asus Aura Sync versions through v1.07.79, consider disabling the MsIo64.sys component until a patch is available to prevent potential exploitation. Restrict access to the vulnerable IOCTL requests to minimize the risk of memory corruption and subsequent DoS or privilege escalation.

Exploit

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2022-44898

Affected Products

Asus Aura Sync

References · 9

• 🔥 https://heegong.github.io/posts/ASUS-AuraSync-Kernel-Stack-Based-Buffer-Overflow-Local-Privilege-Escalation · Exploit
• https://asus.com/content/ASUS-Product-Security-Advisory · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-44898 · Vendor Advisory
• https://asus.com/campaign/aura/us/download.php · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-44898 · Security Note
• http://packetstormsecurity.com/files/174447/MsIo64-LOLDriver-Memory-Corruption.html · Note
• https://t.me/cvenotify/39843 · Telegram Post
• https://t.me/defcon_news/117658 · Telegram Post
• https://t.me/cibsecurity/54521 · Telegram Post