Weaknesses of type CWE-782

51 results

IOCTL exposto sem controle de acesso adequado

Uma interface IOCTL (chamada de controle de dispositivo) fica acessível sem validação suficiente de permissões do usuário, permitindo que processos não autorizados executem operações restritas no kernel ou driver. O resultado é acesso não autorizado a funcionalidades críticas do sistema.

Example

Um driver de hardware implementa um IOCTL para resetar o dispositivo, mas não verifica se o chamador é root ou membro do grupo apropriado. Um usuário comum consegue chamar esse IOCTL via ioctl() e desabilitar o hardware inteiro do sistema, causando negação de serviço.

How to mitigate

Validar explicitamente as credenciais (UID/GID) ou capabilities do processo chamador antes de processar qualquer IOCTL. Use funções como capable() no kernel ou getuid() em userland, e implemente whitelist de usuários/grupos autorizado para cada operação sensível.

CVE-2026-75809MEDIUMExposed IOCTL with insufficient access control in ASUS Armoury Crate allows a local user to disclosure information and disabling device funcEPSS 0.1%CVE-2026-38765HIGHAn issue in Unistal Systems Pvt. Ltd.Protegent 360 v2.0.0.4 allows a local attacker to escalate privileges via the kernel driver pgsecdl.sysEPSS 0.1%CVE-2026-38766HIGHAn issue in Unistal Systems Pvt. Ltd.Protegent 360 v2.0.0.4 allows a local attacker to escalate privileges via the sub_186f4 functionEPSS 0.1%CVE-2019-25764HIGH**UNSUPPORTED WHEN ASSIGNED**  Exposed IOCTL with Insufficient Access Control in the ASUS AURA SYNC driver allows a local user to bypass theEPSS 0.1%CVE-2026-109836HIGHThe Core Temp kernel driver provided by ALCPU is vulnerable to insufficient access control in an exposed IOCTL, which may allow physical memEPSS 0.1%CVE-2026-16004MEDIUMExposed IOCTL with Insufficient Access Control in Armoury Crate driver allows a local user to read and write arbitrary PCI/PCIe configuratioEPSS 0.1%CVE-2026-16003LOWExposed IOCTL with Insufficient Access Control in Armoury Crate driver allows a local user to add an arbitrary process identifier to the driEPSS 0.1%CVE-2026-108889MEDIUMYungengxin Cloud Billing IOCTL Process Termination LWBilling64.sys sub_14000443C exposed ioctl with insufficient access controlEPSS 0.1%CVE-2025-27535MEDIUMExposed ioctl with insufficient access control in the firmware for some Intel(R) Ethernet Connection E825-C. before version NVM ver. 3.84 wiEPSS 0.1%CVE-2026-112116HIGHAn exposed IOCTL with insufficient access control in ASUS System Control Interface allows a local, low-privileged user to read and write arbEPSS 0.1%CVE-2026-6737LOWAn Exposed IOCTL with Insufficient Access Control vulnerability in AsusPTPFilter allows a local user to bypass driver security mechanisms anEPSS 0.1%