Vulnerability · Published Aug 5, 2021 · Assigned by talos
CVE-2021-21790
Medium 6.5
In plain English
A medium-severity security flaw in IOBit. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).
Official description
An information disclosure vulnerability exists in the the way IOBit Advanced SystemCare Ultimate 14.2.0.220 driver handles Privileged I/O read requests. A specially crafted I/O request packet (IRP) can lead to privileged reads in the context of a driver which can result in sensitive information disclosure from the kernel. The IN instruction can read two bytes from the given I/O device, potentially leaking sensitive device data to unprivileged users.
Affected products (as reported)
Weakness: CWE-782 · Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
References
- https://talosintelligence.com/vulnerability_reports/TALOS-2021-1255 x_refsource_MISC