Monthly
ASRock Polychrome SYNC/RGB kernel driver improperly restricts I/O port access via its IOCTL interface, allowing any authenticated local user to force an OS reboot. The driver, installed as part of ASRock's RGB lighting control software for motherboards and VGA cards, accepts crafted IOCTL requests without sufficient validation of target I/O ports, enabling a low-privileged local attacker to cause system-wide availability failure. No public exploit or KEV listing exists at time of analysis; the TWCERT advisory is the primary disclosure source.
Local privilege escalation in ASUS Armoury Crate allows a low-privileged local user to bypass the software's driver authentication and directly access model-specific registers (MSRs) or other hardware control interfaces, enabling unauthorized modification of hardware configuration settings such as voltage, power limits, and thermal thresholds. This is classified under CWE-1256, which covers software that fails to properly restrict userland access to hardware-level features exposed through drivers. In a worst case, exploitation could result in irreversible hardware damage by pushing components beyond manufacturer-safe operating parameters. No public exploit code or active exploitation has been identified at time of analysis.
A potential security vulnerability has been identified in the System BIOS for some HP PC products which may allow escalation of privilege, arbitrary code execution, denial of service, or information. Rated high severity (CVSS 7.3), this vulnerability is no authentication required. No vendor patch available.
Improper restriction of software interfaces to hardware features for some Intel(R) Xeon(R) 6 processor with E-cores when using Intel(R) Trust Domain Extensions (Intel(R) TDX) or Intel(R) Software. Rated medium severity (CVSS 5.6). No vendor patch available.
ASRock Polychrome SYNC/RGB kernel driver improperly restricts I/O port access via its IOCTL interface, allowing any authenticated local user to force an OS reboot. The driver, installed as part of ASRock's RGB lighting control software for motherboards and VGA cards, accepts crafted IOCTL requests without sufficient validation of target I/O ports, enabling a low-privileged local attacker to cause system-wide availability failure. No public exploit or KEV listing exists at time of analysis; the TWCERT advisory is the primary disclosure source.
Local privilege escalation in ASUS Armoury Crate allows a low-privileged local user to bypass the software's driver authentication and directly access model-specific registers (MSRs) or other hardware control interfaces, enabling unauthorized modification of hardware configuration settings such as voltage, power limits, and thermal thresholds. This is classified under CWE-1256, which covers software that fails to properly restrict userland access to hardware-level features exposed through drivers. In a worst case, exploitation could result in irreversible hardware damage by pushing components beyond manufacturer-safe operating parameters. No public exploit code or active exploitation has been identified at time of analysis.
A potential security vulnerability has been identified in the System BIOS for some HP PC products which may allow escalation of privilege, arbitrary code execution, denial of service, or information. Rated high severity (CVSS 7.3), this vulnerability is no authentication required. No vendor patch available.
Improper restriction of software interfaces to hardware features for some Intel(R) Xeon(R) 6 processor with E-cores when using Intel(R) Trust Domain Extensions (Intel(R) TDX) or Intel(R) Software. Rated medium severity (CVSS 5.6). No vendor patch available.