ASUS System Control Interface Untrusted Pointer Dereference Vulnerability Allowing Arbitrary Memory Operations

A vulnerability exists in ASUS System Control Interface versions 3.1.59.0 (x64) and earlier, as well as in ASUS Business Manager versions prior to 3.0.38.0. This vulnerability allows local administrators to perform arbitrary read and write operations on physical memory. The issue arises from an untrusted pointer dereference in the ASUS System Control Interface, which enables the manipulation of memory through crafted IOCTL requests to the driver, bypassing operating system memory protections.

Impact

Exploitation of this vulnerability could lead to unauthorized memory access and manipulation, potentially allowing for the execution of arbitrary code or the introduction of malicious payloads.

Remediation

Users are advised to update to ASUS System Control Interface version 3.1.66.0 or later, and to update ASUS Business Manager to version 3.0.38.0 or later.