Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Vulnerabilities

Privilege Escalation Vulnerability Found in LG Device Manager

A privilege escalation vulnerability that allows attackers to elevate permissions to SYSTEM has been found in the LG Device Manager application provided by the tech giant for its laptops.

A privilege escalation vulnerability that allows attackers to elevate permissions to SYSTEM has been found in the LG Device Manager application provided by the tech giant for its laptops.

A researcher who uses the online moniker Jackson T. analyzed the tool’s low-level hardware access (LHA) kernel-mode driver, which is associated with the LG Device Manager system service. Specifically, he tested the lha.sys and lha32.sys files shipped with version 1.1.1703.1700.

The security hole, tracked as CVE-2019-8372, allows an attacker who already has non-admin access to the targeted device to abuse the Device Manager app to escalate privileges to SYSTEM.

“This driver is used for Low-level Hardware Access (LHA) and includes IOCTL dispatch functions that can be used to read and write to arbitrary physical memory. When it is loaded, the device created by the driver is accessible to non-administrative users which could allow them to leverage those functions to elevate privileges,” the researcher explained.

According to Jackson, the issue was reported to LG on November 18 and the vendor informed him on February 13 that a patch is being released. The researcher said LG provided him an updated version of the driver for testing roughly one week after he notified the company, and he confirmed that a fix he had proposed was properly implemented.

At the time of writing, there is no mention of the vulnerability on the LG Product Security website.

The researcher has created proof-of-concept (PoC) exploits for both Windows 7 and Windows 10, and published a blog post containing technical details, along with a video showing the exploit in action.

Related: Dormant Keylogger Functionality Found in HP Laptops

Related: LG Patches Serious Vulnerabilities in Smartphone Keyboard

Related: Unpatched Flaw Exposes LG NAS Devices to Remote Attacks

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Expert Insights

Related Content

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

IoT Security

Lexmark warns of a remote code execution (RCE) vulnerability impacting over 120 printer models, for which PoC code has been published.

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.

Application Security

Drupal released updates that resolve four vulnerabilities in Drupal core and three plugins.

Email Security

Microsoft is urging customers to install the latest Exchange Server updates and harden their environments to prevent malicious attacks.

Mobile & Wireless

Technical details published for an Arm Mali GPU flaw leading to arbitrary kernel code execution and root on Pixel 6.

Vulnerabilities

Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Application Security

A CSRF vulnerability in the source control management (SCM) service Kudu could be exploited to achieve remote code execution in multiple Azure services.