Falhas do tipo CWE-782

40 resultados

IOCTL Exposto com Controle de Acesso Insuficiente

Uma operação IOCTL (comando de controle de dispositivo) fica acessível a usuários sem privilégios suficientes, permitindo que qualquer processo execute ações administrativas ou acesse dados sensíveis do kernel/hardware. O erro ocorre quando o driver não valida adequadamente quem está tentando chamar a operação, ou valida de forma incompleta.

Exemplo

Um driver de GPU expõe um IOCTL para resetar memória de vídeo, mas não verifica se o processo que o chamou está em grupo de usuários autorizados. Um app malicioso consegue invocar o IOCTL e interferir no funcionamento de outro processo gráfico, ou vazar dados de memória de vídeo.

Como mitigar

Validar e enforçar permissões antes de processar qualquer IOCTL: verificar UID/GID, capabilities do processo, ou usar mecanismos como SELinux/AppArmor. Nunca confiar no usuário que faz a chamada; implementar controle de acesso explícito e granular para cada operação sensível.

CVE-2021-21551HIGHDell dbutil_2_3.sys driver contains an insufficient access control vulnerability which may lead to escalation of privileges, denial of serviEPSS 53.1%KEVCVE-2025-7771HIGHCode Execution / Escalation of Privileges in ThrottleStopEPSS 6.8%CVE-2024-32370CRITICALAn issue in HSC Cybersecurity HC Mailinspector 5.2.17-3 through 5.2.18 allows a remote attacker to obtain sensitive information via a crafteEPSS 1.0%CVE-2024-30804CRITICALAn issue discovered in the DeviceIoControl component in ASUS Fan_Xpert before v.10013 allows an attacker to execute arbitrary code via craftEPSS 0.8%CVE-2024-39251CRITICALAn issue in the component ControlCenter.sys/ControlCenter64.sys of ThundeRobot Control Center v2.0.0.10 allows attackers to access sensitiveEPSS 0.7%CVE-2024-33220HIGHAn issue in the component AslO3_64.sys of ASUSTeK Computer Inc AISuite3 v3.03.36 3.03.36 allows attackers to escalate privileges and executeEPSS 0.7%CVE-2026-36355HIGHThe rtl8192cd Wi-Fi kernel driver in the Realtek rtl819x Jungle SDK (all known versions through v3.4.14B) does not perform any access controEPSS 0.7%CVE-2024-4196CRITICALAvaya IP Office Web Control RCE VulnerabilityEPSS 0.6%CVE-2024-0141MEDIUMNVIDIA Hopper HGX for 8-GPU contains a vulnerability in the GPU vBIOS that may allow a malicious actor with tenant level GPU access to writeEPSS 0.5%CVE-2025-26125HIGHAn exposed ioctl in the IMFForceDelete driver of IObit Malware Fighter v12.1.0 allows attackers to arbitrarily delete files and escalate priEPSS 0.5%CVE-2023-35841HIGHWinFlash Driver Permissions IssueEPSS 0.4%CVE-2025-8061HIGHA potential insufficient access control vulnerability was reported in the Lenovo Dispatcher 3.0 and Dispatcher 3.1 drivers used by some LenoEPSS 0.4%CVE-2021-21792MEDIUMAn information disclosure vulnerability exists in the the way IOBit Advanced SystemCare Ultimate 14.2.0.220 driver handles Privileged I/O reEPSS 0.3%CVE-2021-21787HIGHA privilege escalation vulnerability exists in the way IOBit Advanced SystemCare Ultimate 14.2.0.220 driver handles Privileged I/O write reqEPSS 0.3%CVE-2021-21790MEDIUMAn information disclosure vulnerability exists in the the way IOBit Advanced SystemCare Ultimate 14.2.0.220 driver handles Privileged I/O reEPSS 0.3%CVE-2021-21791MEDIUMAn information disclosure vulnerability exists in the the way IOBit Advanced SystemCare Ultimate 14.2.0.220 driver handles Privileged I/O reEPSS 0.3%CVE-2021-21785MEDIUMAn information disclosure vulnerability exists in the IOCTL 0x9c40a148 handling of IOBit Advanced SystemCare Ultimate 14.2.0.220. A speciallEPSS 0.3%CVE-2021-21788HIGHA privilege escalation vulnerability exists in the way IOBit Advanced SystemCare Ultimate 14.2.0.220 driver handles Privileged I/O write reqEPSS 0.3%CVE-2021-21789HIGHA privilege escalation vulnerability exists in the way IOBit Advanced SystemCare Ultimate 14.2.0.220 driver handles Privileged I/O write reqEPSS 0.3%CVE-2026-4483HIGHAn exposed IOCTL with an  insufficient access control vulnerability has been identified in the utility, MxGeneralIo, for Moxa’s industrial xEPSS 0.3%