Security vulnerability in current version of CPU-Z

[networkArchitect]

A vulnerability in CPUID CPU-Z has been reported under CVE-2017-15302. This vulnerability allows for arbitrary reading/writing of locations in memory without proper permissions. At the time of writing (10/15/2017) there is currently no fix available. IMO this isn't anything to panic over quite yet, though if you're super paranoid uninstalling and waiting for a fix to be released might be a good idea. 

 

CVE Report: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15302

Slightly more info: https://github.com/akayn/Bugs/tree/master/CVE-2017-15302

 

Quote

In CPUID CPU-Z through 1.81, there are improper access rights to a kernel-mode driver (e.g., cpuz143_x64.sys for version 1.43) that can result in information disclosure or elevation of privileges, because of an arbitrary read of any physical address (ioctl: 0x9C402604). Any application running on the system (Windows), including sandboxed users, can issue an ioctl to this driver without any validation. Furthermore, the driver can map any physical page on the system and returns the allocated map page address to the user: that results in an information leak and EoP. NOTE: the vendor indicates that the arbitrary read itself is intentional behavior (for ACPI scan functionality); the security issue is the lack of an ACL.

 

 

[arnavvr]

Doesn't seem like that big of a deal tbh.

[ionbasa]

37 minutes ago, arnavvr said:

Doesn't seem like that big of a deal tbh.

LOL. The CPU-Z driver can be called by third party applications to read memory (without any sort of validation). Not a big deal, yeah. /s

[Jito463]

One of the reasons I'm glad I use the zip version of CPU-Z, instead of the installer version.  Frankly, there's no real reason to actually install CPU-Z, considering everything works fine without being installed.

[dalekphalm]

1 hour ago, Jito463 said:

One of the reasons I'm glad I use the zip version of CPU-Z, instead of the installer version.  Frankly, there's no real reason to actually install CPU-Z, considering everything works fine without being installed.

Convenience is the reason to install it. 

 

There are many applications that have fully capable portable versions, and they certainly have their use case.

 

I use portable apps all the time at work on a USB drive. But on a permanent system I prefer to install where possible. 

[BDev]

17 minutes ago, dalekphalm said:

Convenience is the reason to install it. 

 

There are many applications that have fully capable portable versions, and they certainly have their use case.

 

I use portable apps all the time at work on a USB drive. But on a permanent system I prefer to install where possible. 

Wouldn't that be the same thing, except that you have to click more times? 

[Misanthrope]

24 minutes ago, dalekphalm said:

Convenience is the reason to install it. 

 

There are many applications that have fully capable portable versions, and they certainly have their use case.

 

I use portable apps all the time at work on a USB drive. But on a permanent system I prefer to install where possible. 

Generally speaking, yeah.

 

But seriously how often do you really need to open CPU-Z? If you need the info just take a screenshot of it after any upgrade or new clock or whatever. If you need to benchmark again, assuming you can't use other benchmarks for most people after you get the stable clocks you want you probably don't need to keep testing.

 

I mean it sucks for hardware vendors and reviewers but outside of it there's not much point in keeping it installed for now, specially before this hole is even patched.

[dalekphalm]

1 hour ago, BDev said:

Wouldn't that be the same thing, except that you have to click more times? 

The first time? Sure. But after that? Of course not, unless you store the folder on your desktop. 

 

1 hour ago, Misanthrope said:

Generally speaking, yeah.

 

But seriously how often do you really need to open CPU-Z? If you need the info just take a screenshot of it after any upgrade or new clock or whatever. If you need to benchmark again, assuming you can't use other benchmarks for most people after you get the stable clocks you want you probably don't need to keep testing.

 

I mean it sucks for hardware vendors and reviewers but outside of it there's not much point in keeping it installed for now, specially before this hole is even patched.

True enough - in this case, the risk of the flaw outweighs the convenience of an install for a program - as you correctly point out - that will rarely get used. 

[BDev]

3 hours ago, dalekphalm said:

The first time? Sure. But after that? Of course not, unless you store the folder on your desktop. 

 

True enough - in this case, the risk of the flaw outweighs the convenience of an install for a program - as you correctly point out - that will rarely get used. 

Agree.