SB2018102614 - Multiple vulnerabilities in ASRock Drivers
Published: October 26, 2018
Security Bulletin ID
SB2018102614
Severity
High
Patch available
YES
Number of vulnerabilities
4
Exploitation vector
Remote access
Highest impact
Information disclosure
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 secuirty vulnerabilities.
1) Information disclosure (CVE-ID: CVE-2018-10710)
The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.The weakness exists due to input/output control code in the driver, which exposed functionality to read and write arbitrary physical memory. A remote attacker can gain access to arbitrary data that may be used to gain elevated privileges.
2) Privilege escalation (CVE-ID: CVE-2018-10709)
The vulnerability allows a remote attacker to gain elevated privileges on the target system.The weakness exists due to the drivers expose functionality to read and write control register (CR) values. A remote attacker can execute arbitrary code with elevated privileges.
Successful exploitation of the vulnerability may result in system compromise.
3) Privilege escalation (CVE-ID: CVE-2018-10711)
The vulnerability allows a remote attacker to gain elevated privileges on the target system.The weakness exists due to the drivers expose functionality to read and write Machine Specific Registers (MSRs). A remote attacker can execute arbitrary ring-0 code with elevated privileges.
Successful exploitation of the vulnerability may result in system compromise.
4) Privilege escalation (CVE-ID: CVE-2018-10712)
The vulnerability allows a remote attacker to gain elevated privileges on the target system.The weakness exists due to exposure of functionality to read/write data from/to IO ports. A remote attacker can execute arbitrary code with elevated privileges.
Successful exploitation of the vulnerability may result in system compromise.
Remediation
Install update from vendor's website.