High
CVE-2019-19452
CVE ID
AttackerKB requires a CVE ID in order to pull vulnerability data and references from the CVE list and the National Vulnerability Database. If available, please supply below:
Add References:
CVE-2019-19452
MITRE ATT&CK
Collection
Command and Control
Credential Access
Defense Evasion
Discovery
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Topic Tags
Description
A buffer overflow was found in Patriot Viper RGB through 1.1 when processing IoControlCode 0x80102040. Local attackers (including low integrity processes) can exploit this to gain NT AUTHORITY\SYSTEM privileges.
Add Assessment
Ratings
-
Attacker ValueHigh
-
ExploitabilityVery High
Technical Analysis
Overview
A vulnerability was discovered within the Viper driver RGB version 11, where it did not properly perform input sanitize action against IOCTL 0x80102040 input from user mode. Successful exploitation of this vulnerability leads to the escalation of a user’s privilege, allowing for an unauthorized and unauthenticated user to obtain system privileges. The vulnerability class for this driver CVE is a standard stack-based buffer overflow.
A proof-of-concept does exist, provided by core security, the proof-of-concept is proven to work on a Windows 7 system, porting this vulnerability to a higher version of Windows would require additional security mitigation bypasses.
Impact
Including this vulnerable version of this driver on your system will lead to a degradation of integrity and diminishes all aspects of security for the host. This vulnerable driver allows for an attacker to obtain higher levels of privilege than they’re supposed to have from an unauthenticated standpoint.
Recommended remediation
The recommended remediation for this vulnerability is to update your drivers and to follow any guidelines for updating the software that provides this vulnerable driver.
Would you also like to delete your Exploited in the Wild Report?
Delete Assessment Only Delete Assessment and Exploited in the Wild ReportCVSS V3 Severity and Metrics
General Information
Vendors
- patriotmemory
Products
- viper rgb driver
References
Additional Info
Technical Analysis
Report as Emergent Threat Response
Report as Exploited in the Wild
CVE ID
AttackerKB requires a CVE ID in order to pull vulnerability data and references from the CVE list and the National Vulnerability Database. If available, please supply below:
