CVE-2023-31096

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

A

n issue was discovered in Broadcom) LSI PCI-SV92EX Soft Modem Kernel Driver through 2.2.100.1 (aka AGRSM64.sys). There is Local Privilege Escalation to SYSTEM via a Stack Overflow in RTLCopyMemory (IOCTL 0x1b2150). An attacker can exploit this to elevate privileges from a medium-integrity process to SYSTEM. This can also be used to bypass kernel-level protections such as AV or PPL, because exploit code runs with high-integrity privileges and can be used in coordinated BYOVD (bring your own vulnerable driver) ransomware campaigns.

References

Link	Resource
https://cschwarz1.github.io/posts/0x04/	Exploit Third Party Advisory
https://www.broadcom.com	Not Applicable
https://cschwarz1.github.io/posts/0x04/	Exploit Third Party Advisory
https://www.broadcom.com	Not Applicable

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:broadcom:lsi_pci-sv92ex_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:broadcom:lsi_pci-sv92ex:-:*:*:*:*:*:*:*

History

21 Nov 2024, 08:01

Type	Values Removed	Values Added
References	~~() https://cschwarz1.github.io/posts/0x04/ - Exploit, Third Party Advisory~~	() https://cschwarz1.github.io/posts/0x04/ - Exploit, Third Party Advisory
References	~~() https://www.broadcom.com - Not Applicable~~	() https://www.broadcom.com - Not Applicable

Information

Published : 2023-10-10 19:15

Updated : 2024-11-21 08:01

NVD link : CVE-2023-31096

Mitre link : CVE-2023-31096

CVE.ORG link : CVE-2023-31096

JSON object : View

Products Affected

CWE

CWE-787

Out-of-bounds Write

{"id": "CVE-2023-31096", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2023-10-10T19:15:09.530", "references": [{"url": "https://cschwarz1.github.io/posts/0x04/", "tags": ["Exploit", "Third Party Advisory"], "source": "[email protected]"}, {"url": "https://www.broadcom.com", "tags": ["Not Applicable"], "source": "[email protected]"}, {"url": "https://cschwarz1.github.io/posts/0x04/", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.broadcom.com", "tags": ["Not Applicable"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Broadcom) LSI PCI-SV92EX Soft Modem Kernel Driver through 2.2.100.1 (aka AGRSM64.sys). There is Local Privilege Escalation to SYSTEM via a Stack Overflow in RTLCopyMemory (IOCTL 0x1b2150). An attacker can exploit this to elevate privileges from a medium-integrity process to SYSTEM. This can also be used to bypass kernel-level protections such as AV or PPL, because exploit code runs with high-integrity privileges and can be used in coordinated BYOVD (bring your own vulnerable driver) ransomware campaigns."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en Broadcom) LSI PCI-SV92EX Soft Modem Kernel Driver hasta 2.2.100.1 (tambi\u00e9n conocido como AGRSM64.sys). Hay una escalada de privilegios local al SYSTEM a trav\u00e9s de un desbordamiento de pila en RTLCopyMemory (IOCTL 0x1b2150). Un atacante puede aprovechar esto para elevar los privilegios de un proceso de integridad media al SYSTEM. Esto tambi\u00e9n se puede utilizar para omitir protecciones a nivel de kernel como AV o PPL, porque el c\u00f3digo de explotaci\u00f3n se ejecuta con privilegios de alta integridad y se puede utilizar en campa\u00f1as coordinadas de ransomware BYOVD (traiga su propio controlador vulnerable)."}], "lastModified": "2024-11-21T08:01:24.497", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:broadcom:lsi_pci-sv92ex_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B800F3FF-2B88-4135-9E76-CDA5B582F00D", "versionEndIncluding": "2.2.100.1"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:broadcom:lsi_pci-sv92ex:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "9EE609F6-C73C-4152-B748-4860C45D8BB7"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "[email protected]"}