CVE-2017-9769
CriticalSummary
In Razer Synapse 2.20.15.1104, there is a vulnerability that allows a specially crafted IOCTL to be sent to the rzpnk.sys driver. This can lead to opening a handle to an arbitrary process.
Risk Assessment
An attacker could gain access to system processes, potentially leading to privilege escalation and full control over the system.
Recommendation
It is recommended to update Razer Synapse software to the latest version to mitigate this vulnerability.
Other vulnerabilities in Razer Synapse 2.20.15.1104
See all- CVE-2017-11653High
Razer Synapse version 2.20.15.1104 and earlier uses weak permissions for the Devices directory, allowing local users to gain privileges via a Trojan horse in the RazerConfigNative.dll or RazerConfigNativeLOC.dll files.
- CVE-2017-11652High
Razer Synapse version 2.20.15.1104 and earlier uses weak permissions for the CrashReporter directory, allowing local users to gain privileges via a malicious dbghelp.dll file.
Original NVD description (English source)
A specially crafted IOCTL can be issued to the rzpnk.sys driver in Razer Synapse 2.20.15.1104 that is forwarded to ZwOpenProcess allowing a handle to be opened to an arbitrary process.