Vulnerability Description
An issue was discovered in Broadcom) LSI PCI-SV92EX Soft Modem Kernel Driver through 2.2.100.1 (aka AGRSM64.sys). There is Local Privilege Escalation to SYSTEM via a Stack Overflow in RTLCopyMemory (IOCTL 0x1b2150). An attacker can exploit this to elevate privileges from a medium-integrity process to SYSTEM. This can also be used to bypass kernel-level protections such as AV or PPL, because exploit code runs with high-integrity privileges and can be used in coordinated BYOVD (bring your own vulnerable driver) ransomware campaigns.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Broadcom | Lsi Pci-Sv92Ex Firmware | <= 2.2.100.1 |
| Broadcom | Lsi Pci-Sv92Ex | - |
Related Weaknesses (CWE)
References
- https://cschwarz1.github.io/posts/0x04/ExploitThird Party Advisory
- https://www.broadcom.comNot Applicable
- https://cschwarz1.github.io/posts/0x04/ExploitThird Party Advisory
- https://www.broadcom.comNot Applicable
FAQ
What is CVE-2023-31096?
CVE-2023-31096 is a vulnerability with a CVSS score of 7.8 (HIGH). An issue was discovered in Broadcom) LSI PCI-SV92EX Soft Modem Kernel Driver through 2.2.100.1 (aka AGRSM64.sys). There is Local Privilege Escalation to SYSTEM via a Stack Overflow in RTLCopyMemory (I...
How severe is CVE-2023-31096?
CVE-2023-31096 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-31096?
Check the references section above for vendor advisories and patch information. Affected products include: Broadcom Lsi Pci-Sv92Ex Firmware, Broadcom Lsi Pci-Sv92Ex.