A privilege escalation vulnerability that allows attackers to elevate permissions to SYSTEM has been found in the LG Device Manager application provided by the tech giant for its laptops.
A researcher who uses the online moniker Jackson T. analyzed the tool’s low-level hardware access (LHA) kernel-mode driver, which is associated with the LG Device Manager system service. Specifically, he tested the lha.sys and lha32.sys files shipped with version 1.1.1703.1700.
The security hole, tracked as CVE-2019-8372, allows an attacker who already has non-admin access to the targeted device to abuse the Device Manager app to escalate privileges to SYSTEM.
“This driver is used for Low-level Hardware Access (LHA) and includes IOCTL dispatch functions that can be used to read and write to arbitrary physical memory. When it is loaded, the device created by the driver is accessible to non-administrative users which could allow them to leverage those functions to elevate privileges,” the researcher explained.
According to Jackson, the issue was reported to LG on November 18 and the vendor informed him on February 13 that a patch is being released. The researcher said LG provided him an updated version of the driver for testing roughly one week after he notified the company, and he confirmed that a fix he had proposed was properly implemented.
At the time of writing, there is no mention of the vulnerability on the LG Product Security website.
The researcher has created proof-of-concept (PoC) exploits for both Windows 7 and Windows 10, and published a blog post containing technical details, along with a video showing the exploit in action.
Related: Dormant Keylogger Functionality Found in HP Laptops
Related: LG Patches Serious Vulnerabilities in Smartphone Keyboard
Related: Unpatched Flaw Exposes LG NAS Devices to Remote Attacks
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- ICS Cybersecurity Firm Opscura Launches With $9.4 Million in Series A Funding
- Patch Released for Actively Exploited GoAnywhere MFT Zero-Day
- VMware Says No Evidence of Zero-Day Exploitation in ESXiArgs Ransomware Attacks
- Critical Baicells Device Vulnerability Can Expose Telecoms Networks to Snooping
- SecurityWeek Analysis: Over 450 Cybersecurity M&A Deals Announced in 2022
- VMware ESXi Servers Targeted in Ransomware Attack via Old Vulnerability
- High-Severity Privilege Escalation Vulnerability Patched in VMware Workstation
- GoAnywhere MFT Users Warned of Zero-Day Exploit
Latest News
- Germany Appoints Central Bank IT Chief to Head Cybersecurity
- OpenSSL Ships Patch for High-Severity Flaws
- Software Supply Chain Security Firm Lineaje Raises $7 Million
- ICS Cybersecurity Firm Opscura Launches With $9.4 Million in Series A Funding
- Vulnerability Provided Access to Toyota Supplier Management Network
- Patch Released for Actively Exploited GoAnywhere MFT Zero-Day
- Linux Variant of Cl0p Ransomware Emerges
- VMware Says No Evidence of Zero-Day Exploitation in ESXiArgs Ransomware Attacks
