CVE-2022-42455: High severity asus armoury crate service vulnerability
ASUS EC Tool driver (aka d.sys) 1beb15c90dcf7a5234ed077833a0a3e900969b60be1d04fcebce0a9f8994bdbb, as signed by ASUS and shipped with multiple ASUS software products, contains multiple IOCTL handlers that provide raw read and write access to port I/O and MSRs via unprivileged IOCTL calls. Local users can gain privileges.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this ASUS EC Tool driver vulnerability?
The vulnerability ID for this ASUS EC Tool driver vulnerability is CVE-2022-42455.
What is the severity of CVE-2022-42455?
The severity of CVE-2022-42455 is high.
Which ASUS software products are affected by CVE-2022-42455?
The ASUS Armoury Crate software up to version 5.3.4.1 is affected by CVE-2022-42455.
What is the impact of CVE-2022-42455?
CVE-2022-42455 allows local users to gain elevated privileges and perform unauthorized actions through unprivileged IOCTL calls.
How can I fix CVE-2022-42455?
To fix CVE-2022-42455, it is recommended to update the affected ASUS Armoury Crate software to a version beyond 5.3.4.1 or apply any patches or security updates provided by ASUS.