^{CVE-2020-15368:}ASRock RGB Driver Privilege Escalation Vulnerability

Overview

The ASRock RGB Driver (AsrDrv103.sys) contains a critical security vulnerability that allows unprivileged users to access kernel-level functions. The driver exposes dangerous functionality to user mode applications without proper access controls or validation. Specifically, the driver permits user applications to directly manipulate Control Register 3 (CR3), which stores the base address of the page directory and is critical for memory management. By setting CR3 to zero, an attacker can trigger a triple fault (an unrecoverable error) that crashes the system. More sophisticated exploitation could potentially lead to arbitrary code execution with kernel privileges, allowing complete system compromise. This vulnerability affects systems with the ASRock RGB Driver installed, which is commonly bundled with ASRock motherboards for RGB lighting control.

Remediation

1. Update the ASRock RGB Driver to the latest version if a patched version is available.
2. If no patch is available, consider uninstalling the ASRock RGB Driver software.
3. Use alternative RGB control software that doesn't contain this vulnerability.
4. Implement application control or whitelisting to prevent unauthorized applications from interacting with the vulnerable driver.
5. Monitor system logs for unusual activity that might indicate exploitation attempts.
6. Consider implementing least privilege principles for all user accounts to minimize potential impact.

References

1. Original vulnerability disclosure: https://codetector.org/post/asrock_rgb_driver/
2. Proof of concept and technical details: https://github.com/stong/CVE-2020-15368
3. CVE-2020-15368 in the National Vulnerability Database
4. The vulnerability affects Control Register 3 (CR3), which is critical for memory management in x86 processors.
5. This issue is an example of improper access control in kernel-mode drivers, allowing user-mode applications to perform privileged operations.