CVE-2017-15303
HIGH EXPLOITED IN THE WILDCPUID CPU-Z < 1.42 - Unauthenticated Arbitrary Memory Write via ioctl 0x9C402430
Title source: llmExploitation Summary
CVE-2017-15303 has been observed exploited in the wild (reported by VulnCheck KEV, InTheWild.io). EIP tracks 2 public exploits from researchers including hfiref0x, The-Real-TechLord.
AI-analyzed exploit summary Stryker is a multi-purpose PoC tool leveraging CVE-2017-15303 (CPU-Z driver vulnerability) to bypass Driver Signature Enforcement, hijack protected processes, and load unsigned drivers into kernel mode. It uses physical memory manipulation and shellcode injection via SysInternals Process Explorer driver.
Description
In CPUID CPU-Z before 1.43, there is an arbitrary memory write that results directly in elevation of privileges, because any program running on the local machine (while CPU-Z is running) can issue an ioctl 0x9C402430 call to the kernel-mode driver (e.g., cpuz141_x64.sys for version 1.41).
Exploits (2)
Stryker is a multi-purpose PoC tool leveraging CVE-2017-15303 (CPU-Z driver vulnerability) to bypass Driver Signature Enforcement, hijack protected processes, and load unsigned drivers into kernel mode. It uses physical memory manipulation and shellcode injection via SysInternals Process Explorer driver.
Stryker is a multi-purpose proof-of-concept tool that exploits CVE-2017-15303 in CPU-Z's driver to achieve kernel-level memory manipulation, including disabling Driver Signature Enforcement, hijacking protected processes, and loading unsigned drivers. It leverages physical memory read/write capabilities via the vulnerable CPU-Z driver (version 1.41) and SysInternals Process Explorer driver (version 1.52) for shellcode execution.
References (1)
Scores
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H