CVE-2025-51060 (CNNVD-202508-360)
中文标题:
CPUID CPU-Z 安全漏洞
英文标题:
An issue was discovered in CPUID cpuz.sys 1.0.5.4. An attacker can use DeviceIoControl with the unva...
漏洞描述
中文描述:
CPUID CPU-Z是CPUID公司的一款系统硬件信息检测工具。 CPUID CPU-Z 1.0.5.4版本存在安全漏洞，该漏洞源于未验证参数允许修改MSR_LSTAR和hook KiSystemCall64。
英文描述:
An issue was discovered in CPUID cpuz.sys 1.0.5.4. An attacker can use DeviceIoControl with the unvalidated parameters 0x9C402440 and 0x9C402444 as IoControlCodes to perform RDMSR and WRMSR, respectively. Through this process, the attacker can modify MSR_LSTAR and hook KiSystemCall64. Afterward, using Return-Oriented Programming (ROP), the attacker can manipulate the stack with pre-prepared gadgets, disable the SMAP flag in the CR4 register, and execute a user-mode syscall handler in the kernel context. It has not been confirmed whether this works on 32-bit Windows, but it functions on 64-bit Windows if the core isolation feature is either absent or disabled.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| cpuid | cpuz.sys | 1.0.5.4 | - | - |
cpe:2.3:a:cpuid:cpuz.sys:1.0.5.4:*:*:*:*:windows:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
CVSS评分详情
3.1 (adp)
MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2025-51060 |
2025-11-11 15:23:26 | 2025-11-11 07:40:39 |
| NVD | nvd_CVE-2025-51060 |
2025-11-11 15:00:58 | 2025-11-11 07:48:26 |
| CNNVD | cnnvd_CNNVD-202508-360 |
2025-11-11 15:12:52 | 2025-11-11 08:00:08 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 其他
- cnnvd_id: 未提取 -> CNNVD-202508-360
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- affected_products_count: 0 -> 1
- data_sources: ['cve'] -> ['cve', 'nvd']