Low
CVE-2020-17382
CVE-2020-17382
Description
The MSI AmbientLink MsIo64 driver 1.0.0.8 has a Buffer Overflow (0x80102040, 0x80102044, 0x80102050,and 0x80102054).
Add Assessment
Technical Analysis
This is a vulnerability in the MSI AmbientLink Version 1.0.0.8. The vulnerability allows a regular user access to a Windows device created by the msio driver provided for the MSI Ambientlink system.
The software device is vulnerable to a buffer overflow attack because it assumes that the received buffer will always be less than 48 bytes, apparently, even when longer lengths are specified by the IOCTL request.
Realistically, as this software runs LED lights on MSI gaming motherboards, it is unlikely to pose a large threat to corporate environments and instead, poses a larger threat to home users or individually-managed PCs, making the patching process significantly easier. I imagine it is also possible to simply remove the software temporarily.
See https://www.coresecurity.com/core-labs/advisories/msi-ambient-link-multiple-vulnerabilities for a more in-depth analysis and PoC code.
Technical Analysis
Whilst I agree with most of the points @bwatters-r7 makes on this one, I think it is also important to note that as of right now, there does not appear to be a patch for this vulnerability, as if one dives into the CoreSecurity pages they will see that according to CoreSecurity MSI never responded to their request. I can also confirm this by visiting https://www.msi.com/Landing/mystic-light-rgb-gaming-pc/download, and trying to download the latest version of AmbientLink, which at the time is 1.0.0.08. Looking at this ZIP file shows that it was last updated on 2019-10-14, aka October 14th 2019, and given that CoreSecurity moved to full disclosure on 2020-08-07, or August 7th 2020, I think its safe to say that this bug still hasn’t been patched.
Additionally its also important to note that the driver for this software will be signed in such a way that its still trusted by Microsoft machines. Therefore so long as you have permissions to install this driver on a system, you can still gain SYSTEM level code execution on pretty much any Microsoft machine you desire.
Of course the counter argument to this is really two fold. The first is that most of the time you won’t have permissions to install arbitrary software on the target machine, which kind of negates the point I made earlier. Additionally to @bwatters-r7 ’s point, this software is going to be typically installed on a home user’s gamer rig, which limits the number of users that will be affected by this bug and since gamers generally tend to like using the latest and greatest thing, they will be more inclined to apply the updates for this bug when it does get fixed.
So yeah overall feeling is that this is a medium as there is a severe impact, no patch, and working PoC’s for Windows 7 and Windows 10 from CoreSecurity,
CVSS V3 Severity and Metrics
General Information
Vendors
- msi
Products
- ambientlink mslo64 firmware 1.0.0.8
References
