CVE-2021-42688

Vulnerability

An integer overflow vulnerability exists in the IOCTL Handler 0x22005B of the Accops HyWorks Windows Client driver prior to version 3.2.8.200. The flaw resides in the kernel-mode driver component that processes I/O Request Packets (IRPs). When handling specially crafted IOCTL requests, an integer overflow can occur, leading to memory corruption. Affected versions include all releases before v 3.2.8.200 [1].

Exploitation

An attacker must have local access to the system with the ability to send arbitrary IOCTL requests to the vulnerable driver. No additional authentication beyond local user privileges is required. The attacker crafts an I/O Request Packet that triggers the integer overflow when processed by the IOCTL handler 0x22005B. The overflow corrupts kernel memory, enabling the attacker to overwrite critical kernel structures [1].

Impact

Successful exploitation results in arbitrary code execution in kernel mode (ring 0), granting the attacker complete control over the system. The attacker can disable security products, overwrite system components, corrupt the operating system, or perform other malicious operations unimpeded. Additionally, the vulnerability can cause a denial of service (memory corruption and OS crash) [1].

Mitigation

The vulnerability is fixed in Accops HyWorks Windows Client version 3.2.8.200 [1]. Users should update to this version or later. No workaround is documented. The vendor has released security updates; customers are advised to apply them promptly.