Improper input validation in Alps Pointing-Device Driver
CVE-2018-10828
An issue was discovered in Alps Pointing-device Driver 10.1.101.207. ApMsgFwd.exe allows the current user to map and write to the "ApMsgFwd File Mapping Object" section. ApMsgFwd.exe uses the data written to this section as arguments to functions. This causes a denial of service condition when invalid pointers are written to the mapped section. This driver has been used with Dell, ThinkPad, and VAIO devices.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.013 (70.4th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 70th percentile — 70.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.014 · newest: 0.013 · change: -0.001
Affected products
- Alps Pointing-Device Driver — versions 10.1.101.207
Weakness classification (CWE)
References
- www.exploit-db.com/exploits/44610/ (VDB Entry, Third Party Advisory, exploit)
- github.com/SouhailHammou/Exploits/blob/master/CVE-2018-10828/apmsgfwd_exploit_d… (Third Party Advisory)
- support.lenovo.com/us/en/solutions/LEN-25654
Frequently asked questions
- What is CVE-2018-10828?
- CVE-2018-10828 is a medium-severity vulnerability in Alps Pointing-Device Driver, classified under Improper Input Validation. CVSS score: 5.5/10. Published 2018-05-09.
- How severe is CVE-2018-10828?
- Medium severity. CVSS v3 base score is 5.5 out of 10.