CVE-2022-35899
📋 TL;DR
This CVE describes an unquoted service path vulnerability in ASUS Aura Ready Game SDK service (GameSDK.exe) version 1.0.0.4. It allows local attackers to escalate privileges by placing a malicious executable in the unquoted path. This affects Windows systems with the vulnerable ASUS software installed.
💻 Affected Systems
- ASUS Aura Ready Game SDK
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Local attacker gains SYSTEM-level privileges, enabling complete system compromise, data theft, and persistence.
Likely Case
Local user with limited privileges escalates to administrator/SYSTEM rights to install malware or access restricted resources.
If Mitigated
Attack fails due to proper file permissions, antivirus blocking, or lack of local access.
🎯 Exploit Status
Exploit requires local access to create files in Program Files directory. Multiple public proof-of-concept exploits exist.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: No official ASUS advisory found
Restart Required: No
Instructions:
No official patch available. Consider removing the vulnerable software or applying workarounds.
🔧 Temporary Workarounds
Quote Service Path
windowsModify the service configuration to use quoted paths in the service executable path.
sc config "ASUS Aura Ready Game SDK Service" binPath="\"C:\Program Files (x86)\ASUS\GameSDK.exe\""
Restrict File Permissions
windowsSet restrictive permissions on the ASUS directory to prevent unauthorized file creation.
icacls "C:\Program Files (x86)\ASUS" /deny Users:(OI)(CI)W
🧯 If You Can't Patch
- Uninstall ASUS Aura Ready Game SDK if not required
- Implement strict access controls to prevent local users from writing to Program Files directories
🔍 How to Verify
Check if Vulnerable:
Check if GameSDK.exe service exists with unquoted path: sc qc "ASUS Aura Ready Game SDK Service"Check Version:
Check file version of C:\Program Files (x86)\ASUS\GameSDK.exeVerify Fix Applied:
Verify service path is quoted and permissions on C:\Program Files (x86)\ASUS\ are restrictive📡 Detection & Monitoring
Log Indicators:
- Windows Event Logs showing service path modifications
- File creation events in C:\Program Files (x86)\ASUS\
Network Indicators:
- None - local exploitation only
SIEM Query:
EventID=4688 AND (ProcessName="GameSDK.exe" OR CommandLine LIKE "%ASUS%GameSDK%")🔗 References
- https://github.com/AngeloPioAmirante/CVE-2022-35899
- https://packetstormsecurity.com/files/167763/Asus-GameSDK-1.0.0.4-Unquoted-Service-Path.html
- https://www.exploit-db.com/exploits/50985
- https://github.com/AngeloPioAmirante/CVE-2022-35899
- https://packetstormsecurity.com/files/167763/Asus-GameSDK-1.0.0.4-Unquoted-Service-Path.html
- https://www.exploit-db.com/exploits/50985
