CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 3CVE-2022-47631 – Razer Synapse Race Condition / DLL Hijacking
https://notcve.org/view.php?id=CVE-2022-47631
Razer Synapse through 3.7.1209.121307 allows privilege escalation due to an unsafe installation path and improper privilege management. Attackers can place DLLs into %PROGRAMDATA%\Razer\Synapse3\Service\bin if they do so before the service is installed and if they deny write access for the SYSTEM user. Although the service will not start if it detects malicious DLLs in this directory, attackers can exploit a race condition and replace a valid DLL (i.e., a copy of a legitimate Razer DLL) with a malicious DLL after the service has already checked the file. As a result, local Windows users can abuse the Razer driver installer to obtain administrative privileges on Windows. Razer Synapse hasta 3.7.1209.121307 permite la escalada de privilegios debido a una ruta de instalación insegura y una gestión de privilegios inadecuada. • http://packetstormsecurity.com/files/174696/Razer-Synapse-Race-Condition-DLL-Hijacking.html http://seclists.org/fulldisclosure/2023/Sep/6 https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2023-002.txt • CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition •
CVSS: 6.8EPSS: 0%CPEs: 2EXPL: 2CVE-2022-47632 – Razer Synapse 3.7.0731.072516 Local Privilege Escalation
https://notcve.org/view.php?id=CVE-2022-47632
Razer Synapse before 3.7.0830.081906 allows privilege escalation due to an unsafe installation path, improper privilege management, and improper certificate validation. Attackers can place malicious DLLs into %PROGRAMDATA%\Razer\Synapse3\Service\bin if they do so before the service is installed and if they deny write access for the SYSTEM user. Although the service will not start if the malicious DLLs are unsigned, it suffices to use self-signed DLLs. The validity of the DLL signatures is not checked. As a result, local Windows users can abuse the Razer driver installer to obtain administrative privileges on Windows. • http://packetstormsecurity.com/files/170772/Razer-Synapse-3.7.0731.072516-Local-Privilege-Escalation.html http://packetstormsecurity.com/files/174696/Razer-Synapse-Race-Condition-DLL-Hijacking.html http://seclists.org/fulldisclosure/2023/Sep/6 https://syss.de https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-047.txt • CWE-427: Uncontrolled Search Path Element •
CVSS: 7.3EPSS: 0%CPEs: 2EXPL: 3CVE-2021-44226 – Razer Synapse 3.6.x DLL Hijacking
https://notcve.org/view.php?id=CVE-2021-44226
Razer Synapse before 3.7.0228.022817 allows privilege escalation because it relies on %PROGRAMDATA%\Razer\Synapse3\Service\bin even if %PROGRAMDATA%\Razer has been created by any unprivileged user before Synapse is installed. The unprivileged user may have placed Trojan horse DLLs there. Razer Synapse versiones anteriores a 3.7.0228.022817, permite una escalada de privilegios porque es basado en %PROGRAMDATA%\Razer\Synapse3\Service\bin incluso si %PROGRAMDATA%\Razer ha sido creado por cualquier usuario no privilegiado antes de la instalación de Synapse. El usuario no privilegiado puede haber colocado allí DLLs troyanos Razer Synapse versions prior to 3.7.0228.022817 suffer from a dll hijacking vulnerability. • http://packetstormsecurity.com/files/166485/Razer-Synapse-3.6.x-DLL-Hijacking.html http://packetstormsecurity.com/files/170772/Razer-Synapse-3.7.0731.072516-Local-Privilege-Escalation.html http://packetstormsecurity.com/files/174696/Razer-Synapse-Race-Condition-DLL-Hijacking.html http://seclists.org/fulldisclosure/2022/Mar/51 http://seclists.org/fulldisclosure/2023/Jan/26 http://seclists.org/fulldisclosure/2023/Sep/6 https://www.razer.com/community https://www.syss.de/fileadmin/dokumente/Publikationen& • CWE-427: Uncontrolled Search Path Element •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2021-30494
https://notcve.org/view.php?id=CVE-2021-30494
Multiple system services installed alongside the Razer Synapse 3 software suite perform privileged operations on entries within the Razer Chroma SDK subkey. These privileged operations consist of file name concatenation of a runtime log file that is used to store runtime log information. In other words, an attacker can create a file in an unintended directory (with some limitations). Múltiples servicios del sistema instalados junto con el paquete de software Razer Synapse versión 3, llevan a cabo operaciones privilegiadas en las entradas dentro de la subclave Razer Chroma SDK. Estas operaciones privilegiadas consisten en la concatenación de nombres de archivo de un archivo de registro de tiempo de ejecución que es usado para almacenar información de registro de tiempo de ejecución. • https://versprite.com/advisories/razer-synapse-3-1 https://versprite.com/blog/security-research/razer-synapse-3-security-vulnerability-analysis-report https://versprite.com/security-resources • CWE-276: Incorrect Default Permissions •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2021-30493
https://notcve.org/view.php?id=CVE-2021-30493
Multiple system services installed alongside the Razer Synapse 3 software suite perform privileged operations on entries within the ChromaBroadcast subkey. These privileged operations consist of file name concatenation of a runtime log file that is used to store runtime log information. In other words, an attacker can create a file in an unintended directory (with some limitations). Múltiples servicios del sistema instalados junto con el paquete de software Razer Synapse versión 3, llevan a cabo operaciones privilegiadas en las entradas dentro de la subclave ChromaBroadcast. Estas operaciones privilegiadas consisten en la concatenación de nombres de archivo de un archivo de registro de tiempo de ejecución que es usado para almacenar información de registro de tiempo de ejecución. • https://versprite.com/advisories/razer-synapse-3-cve-2021-30493 https://versprite.com/blog/security-research/razer-synapse-3-security-vulnerability-analysis-report https://versprite.com/security-resources • CWE-276: Incorrect Default Permissions •