CVE-2024-55407
Published: 06 January 2025
Summary
CVE-2024-55407 is a high-severity Improper Validation of Specified Quantity in Input (CWE-1284) vulnerability in Ite (inferred from references). Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 27.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-10 (Software Usage Restrictions) and SC-41 (Port and I/O Device Access).
Deeper analysis
CVE-2024-55407 is a vulnerability in the DeviceIoControl function of ITE Tech. Inc.'s ITE IO Access v1.0.0.0. The issue allows attackers to perform arbitrary port read and write actions by supplying crafted IOCTL requests. It is classified under CWE-1284: Improper Validation of Specified Index, Quantity, or Range and carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The vulnerability was published on 2025-01-06.
A local attacker with low privileges (PR:L) can exploit this vulnerability with low attack complexity and no user interaction required. Exploitation involves sending crafted IOCTL requests to the affected component, enabling arbitrary read and write access to hardware ports. This can result in high impacts to confidentiality, integrity, and availability, such as unauthorized data access, modification of system behavior, or disruption of services.
Advisories and additional details are available from the vendor at http://ite.com and a GitHub repository documenting the vulnerable driver at https://github.com/heyheysky/vulnerable-driver/blob/master/CVE-2024-55407/CVE-2024-55407_Winio64.sys_README.md.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-52763
Vulnerability details
An issue in the DeviceloControl function of ITE Tech. Inc ITE IO Access v1.0.0.0 allows attackers to perform arbitrary port read and write actions via supplying crafted IOCTL requests.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local IOCTL-based arbitrary port read/write in a driver directly enables privilege escalation via hardware manipulation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly restricts access to ports and I/O devices, preventing arbitrary read and write actions enabled by crafted IOCTL requests in the vulnerable driver.
Implements input validation mechanisms at IOCTL entry points, addressing the improper validation of index, quantity, or range (CWE-1284) that allows exploitation.
Authorizes and restricts use of vulnerable third-party drivers like ITE IO Access on the system, blocking deployment of the affected WinIo64.sys component.