First published: Thu Apr 08 2021(Updated: )
AsIO2_64.sys and AsIO2_32.sys in ASUS GPUTweak II before 2.3.0.3 allow low-privileged users to trigger a stack-based buffer overflow. This could enable low-privileged users to achieve Denial of Service via a DeviceIoControl.
Credit: cve@mitre.org
Affected Software | Affected Version | How to fix |
---|---|---|
ASUS GPUTweak II | <2.3.0.3 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
The vulnerability ID for this issue is CVE-2021-28686.
CVE-2021-28686 has a severity rating of medium (5.5).
ASUS GPUTweak II versions before 2.3.0.3 are affected by this vulnerability.
Low-privileged users can exploit CVE-2021-28686 to trigger a stack-based buffer overflow.
Low-privileged users can achieve Denial of Service (DoS) via a DeviceIoControl with CVE-2021-28686.
Yes, you can find references for CVE-2021-28686 at the following links: [Link 1](https://gist.github.com/DStraghkov/fba4994ac4bb3a6e2940b21743563df0), [Link 2](https://www.asus.com/Static_WebPage/ASUS-Product-Security-Advisory/).
CVE-2021-28686 is associated with CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-787 (Out-of-bounds Write).