CVE-2020-14979

The WinRing0.sys and WinRing0x64.sys drivers 1.2.0 in EVGA Precision X1 through 1.0.6 allow local users, including low integrity processes, to read and write to arbitrary memory locations. This allows any user to gain NT AUTHORITY\SYSTEM privileges by mapping \Device\PhysicalMemory into the calling process.

CVSS v3 7.8 HIGH
CVSS v2.0 7.2 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.2^/10

CVSS v2.0 : HIGH

Vector : AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 3.9 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://posts.specterops.io/cve-2020-14979-local-privilege-escalation-in-evga-precisionx1-cf63c6b95896	Third Party Advisory
https://www.evga.com/precisionx1/	Product Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:evga:precision_x1::::::::
	cpe:2.3:a:winring0_project:winring0:1.2.0:::::::*

History

No history.

Information

Published : 2020-08-11 18:15

Updated : 2021-07-21 11:39

NVD link : CVE-2020-14979

Mitre link : CVE-2020-14979

CVE.ORG link : CVE-2020-14979

JSON object : View

Products Affected

evga

precision_x1

winring0_project

winring0

CWE

NVD-CWE-noinfo

{"id": "CVE-2020-14979", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.2, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2020-08-11T18:15:12.910", "references": [{"url": "https://posts.specterops.io/cve-2020-14979-local-privilege-escalation-in-evga-precisionx1-cf63c6b95896", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.evga.com/precisionx1/", "tags": ["Product", "Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "The WinRing0.sys and WinRing0x64.sys drivers 1.2.0 in EVGA Precision X1 through 1.0.6 allow local users, including low integrity processes, to read and write to arbitrary memory locations. This allows any user to gain NT AUTHORITY\\SYSTEM privileges by mapping \\Device\\PhysicalMemory into the calling process."}, {"lang": "es", "value": "Los controladores WinRing0.sys y WinRing0x64.sys versi\u00f3n 1.2.0 en EVGA Precision X1 hasta la versi\u00f3n 1.0.6 permiten a los usuarios locales, incluyendo los procesos de baja integridad, leer y escribir en lugares de memoria arbitrarios. Esto permite a cualquier usuario obtener privilegios del SISTEMA DE AUTORIDADES DE NATURALEZA (NT AUTHORITY) al mapear la memoria f\u00edsica del dispositivo en el proceso de llamada"}], "lastModified": "2021-07-21T11:39:23.747", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:evga:precision_x1:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CB6941EE-4DC6-4B71-A4CB-FA3CCD65084E", "versionEndIncluding": "1.0.6"}, {"criteria": "cpe:2.3:a:winring0_project:winring0:1.2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C0D85836-3C82-488A-9B9A-17B1010CB869"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}