CVE-2024-33219 - Vulnerability Details - OpenCVE

An issue in the component AsIO64.sys of ASUSTeK Computer Inc ASUS SABERTOOTH X99 Driver v1.0.1.0 allows attackers to escalate privileges and execute arbitrary code via sending crafted IOCTL requests.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Asus	Sabertooth X99 Sabertooth X99 Firmware

Configuration 1 [-]

AND

cpe:2.3:o:asus:sabertooth_x99_firmware:1.0.1.0:*:*:*:*:*:*:*

cpe:2.3:h:asus:sabertooth_x99:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/DriverHunter/Win-Driver-EXP/tree/main/CVE-2024-33219

History

Fri, 18 Apr 2025 16:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Asus Asus sabertooth X99 Asus sabertooth X99 Firmware
CPEs		cpe:2.3:h:asus:sabertooth_x99:-:::::::* cpe:2.3:o:asus:sabertooth_x99_firmware:1.0.1.0:::::::*
Vendors & Products		Asus Asus sabertooth X99 Asus sabertooth X99 Firmware

Tue, 20 Aug 2024 16:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-782
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2024-05-22T15:03:56.765Z

Updated: 2025-02-13T15:52:29.969Z

Reserved: 2024-04-23T00:00:00.000Z

Link: CVE-2024-33219

Vulnrichment

Updated: 2024-08-02T02:27:53.341Z

NVD

Status : Analyzed

Published: 2024-05-22T15:15:28.680

Modified: 2025-04-18T16:05:10.277

Link: CVE-2024-33219

Redhat

No data.

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2024-33219", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2025-02-13T15:52:29.969Z", "datePublished": "2024-05-22T15:03:56.765Z", "dateReserved": "2024-04-23T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-05-22T15:03:57.072Z"}, "descriptions": [{"lang": "en", "value": "An issue in the component AsIO64.sys of ASUSTeK Computer Inc ASUS SABERTOOTH X99 Driver v1.0.1.0 allows attackers to escalate privileges and execute arbitrary code via sending crafted IOCTL requests."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://github.com/DriverHunter/Win-Driver-EXP/tree/main/CVE-2024-33219"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T02:27:53.341Z"}, "title": "CVE Program Container", "references": [{"url": "https://github.com/DriverHunter/Win-Driver-EXP/tree/main/CVE-2024-33219", "tags": ["x_transferred"]}]}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-782", "lang": "en", "description": "CWE-782 Exposed IOCTL with Insufficient Access Control"}]}], "affected": [{"vendor": "asus", "product": "sabertooth_x99_driver", "cpes": ["cpe:2.3:a:asus:sabertooth_x99_driver:1.0.1.0:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "1.0.1.0", "status": "affected"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-08-20T14:29:18.433672Z", "id": "CVE-2024-33219", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-20T14:32:58.796Z"}}]}, "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/DriverHunter/Win-Driver-EXP/tree/main/CVE-2024-33219", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T02:27:53.341Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-33219", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-08-20T14:29:18.433672Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:asus:sabertooth_x99_driver:1.0.1.0:*:*:*:*:*:*:*"], "vendor": "asus", "product": "sabertooth_x99_driver", "versions": [{"status": "affected", "version": "1.0.1.0"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-782", "description": "CWE-782 Exposed IOCTL with Insufficient Access Control"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-20T14:32:54.792Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://github.com/DriverHunter/Win-Driver-EXP/tree/main/CVE-2024-33219"}], "descriptions": [{"lang": "en", "value": "An issue in the component AsIO64.sys of ASUSTeK Computer Inc ASUS SABERTOOTH X99 Driver v1.0.1.0 allows attackers to escalate privileges and execute arbitrary code via sending crafted IOCTL requests."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-05-22T15:03:57.072050"}}}, "cveMetadata": {"cveId": "CVE-2024-33219", "state": "PUBLISHED", "dateUpdated": "2024-08-20T14:32:58.796Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre"}, "dataVersion": "5.1"}