PT-2023-15443 · Razer · Razer Synapse

Dr. Oliver Schwarz

·

Published

2023-08-31

·

Updated

2024-02-16

·

CVE-2022-47631

CVSS v3.1

7.8

High

VectorAV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Razer Synapse versions 3.7.1209.121307 and earlier
Description The issue allows for privilege escalation due to an unsafe installation path and improper privilege management. Attackers can place DLLs into %PROGRAMDATA%RazerSynapse3Servicebin if they do so before the service is installed and if they deny write access for the SYSTEM user. Although the service will not start if it detects malicious DLLs in this directory, attackers can exploit a race condition and replace a valid DLL with a malicious DLL after the service has already checked the file. As a result, local Windows users can abuse the Razer driver installer to obtain administrative privileges on Windows.
Recommendations For Razer Synapse versions 3.7.1209.121307 and earlier, consider disabling the service until a patch is available to prevent exploitation of the race condition. Restrict access to the %PROGRAMDATA%RazerSynapse3Servicebin directory to minimize the risk of malicious DLL placement. Avoid using the Razer driver installer until the issue is resolved to prevent potential privilege escalation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Time Of Check To Time Of Use

Weakness Enumeration

CWE-367

Related Identifiers

CVE-2022-47631

Affected Products

Razer Synapse