CVE-2021-26943 - OpenCVE

The UX360CA BIOS through 303 on ASUS laptops allow an attacker (with the ring 0 privilege) to overwrite nearly arbitrary physical memory locations, including SMRAM, and execute arbitrary code in the SMM (issue 3 of 3).

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Local

Access Complexity Low

Authentication None

Confidentiality Impact Complete

Integrity Impact Complete

Availability Impact Complete

AV:L/AC:L/Au:N/C:C/I:C/A:C

Vendors & Products
CPE Configurations

Vendors	Products
Asus	Ux360ca Bios Ux360ca

Configuration 1 [-]

AND

cpe:2.3:o:asus:ux360ca_bios:*:*:*:*:*:*:*:*

cpe:2.3:h:asus:ux360ca:-:*:*:*:*:*:*:*

References

Link	Resource
https://www.asus.com/support/FAQ/1045541/	Exploit Vendor Advisory
https://www.youtube.com/watch?v=1H3AfaVyeuk	Exploit Third Party Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: mitre

Published: 2021-03-31T19:26:31

Updated: 2021-03-31T19:26:31

Reserved: 2021-02-09T00:00:00

Link: CVE-2021-26943

JSON object: View

NVD Information

Status : Analyzed

Published: 2021-03-31T20:15:14.130

Modified: 2021-04-07T14:12:42.170

Link: CVE-2021-26943

JSON object: View

Redhat Information

No data.

CWE

NVD-CWE-noinfo

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:asus:ux360ca_bios:*:*:*:*:*:*:*:*", "matchCriteriaId": "195C61B6-8E5A-4890-A23A-1C622071D759", "versionEndExcluding": "304", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:asus:ux360ca:-:*:*:*:*:*:*:*", "matchCriteriaId": "7F7EE6F3-6B7E-4048-B832-D47D509B37F1", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "The UX360CA BIOS through 303 on ASUS laptops allow an attacker (with the ring 0 privilege) to overwrite nearly arbitrary physical memory locations, including SMRAM, and execute arbitrary code in the SMM (issue 3 of 3)."}, {"lang": "es", "value": "El BIOS UX360CA versiones hasta 303 en las computadoras port\u00e1tiles ASUS permite a un atacante (con el privilegio ring 0) sobrescribir ubicaciones de la memoria f\u00edsica casi arbitrarias, incluida la SMRAM, y ejecutar c\u00f3digo arbitrario en la SMM (problema 3 de 3)."}], "id": "CVE-2021-26943", "lastModified": "2021-04-07T14:12:42.170", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.2, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.5, "impactScore": 6.0, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-03-31T20:15:14.130", "references": [{"source": "cve@mitre.org", "tags": ["Exploit", "Vendor Advisory"], "url": "https://www.asus.com/support/FAQ/1045541/"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://www.youtube.com/watch?v=1H3AfaVyeuk"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}