CVE-2020-8808 : Security Advisory and Response

The CorsairLLAccess64.sys and CorsairLLAccess32.sys drivers in CORSAIR iCUE before 3.25.60 allow local non-privileged users to gain NT AUTHORITY\SYSTEM privileges.

Understanding CVE-2020-8808

This CVE involves a vulnerability in CORSAIR iCUE that enables unauthorized users to access and manipulate physical memory, potentially leading to elevated system privileges.

What is CVE-2020-8808?

The vulnerability in Corsair drivers allows local non-privileged users, including low-integrity processes, to read and write to arbitrary physical memory locations, resulting in the ability to gain NT AUTHORITY\SYSTEM privileges through specific function calls.

The Impact of CVE-2020-8808

The exploitation of this vulnerability can lead to unauthorized access to system memory and the escalation of privileges, posing a significant security risk to affected systems.

Technical Details of CVE-2020-8808

This section provides more in-depth technical information about the CVE.

Vulnerability Description

The CorsairLLAccess64.sys and CorsairLLAccess32.sys drivers in CORSAIR iCUE before version 3.25.60 allow unauthorized users to read and write to arbitrary physical memory locations, potentially leading to the elevation of privileges.

Affected Systems and Versions

Affected System: CORSAIR iCUE
Vulnerable Versions: Before 3.25.60

Exploitation Mechanism

Unauthorized users, including low-integrity level processes, can exploit this vulnerability by making specific function calls such as MmMapIoSpace to gain elevated privileges.

Mitigation and Prevention

To address and prevent the exploitation of CVE-2020-8808, follow these mitigation strategies:

Immediate Steps to Take

Update CORSAIR iCUE to version 3.25.60 or later to mitigate the vulnerability.
Restrict access to vulnerable systems to trusted users only.

Long-Term Security Practices

Regularly monitor and audit system memory access and privilege escalation attempts.
Implement the principle of least privilege to limit user access rights.

Patching and Updates

Apply security patches and updates promptly to ensure system protection against known vulnerabilities.