The Rawether framework for Windows, originally produced by Printing Communications Assoc., Inc. (PCAUSA), is a framework that facilitates communication between an application and the Network Driver Interface System (NDIS) protocol. This framework is used by many different hardware vendors in their WiFi and router control applications. Rawether implements the Berkeley Packet Filter (BPF) mechanism. BPF filters are compiled into small programs that are executed by a BPF virtual machine.

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer - CVE-2017-3196

The Rawether framework does not properly validate BPF programs before execution, allowing BPF programs that may read/write arbitrary memory or infinitely loop. The return address on the stack may be overwritten, allowing a local user to execute arbitrary code with SYSTEM privileges.

To enable the vulnerable part of the driver, an exploit has to issue a OID_GEN_CURRENT_PACKET_FILTER NDIS request with NDIS_PACKET_TYPE_ALL_LOCAL flags and set the BPF program. The exploit is triggered by reading the first received network packet.

The researcher has provided a proof of concept affecting the 64-bit version of PcaSp60.sys driver which is part of ASUS PCE-AC56 WLAN Card Utilities. However, other utilities and programs making use of this driver may also be affected. Identifying vulnerable software may be difficult due to variations in driver name, version, or device name or information, but the vulnerable driver is most likely included in OEM WiFi utility programs. Some common default naming convention for the affected drivers include:

A local authenticated attacker may be able to execute a malicious BPF program that can execute arbitrary code with SYSTEM privileges.

Apply an update or uninstall affected software

Apply an update to any software that makes use of the Rawether driver. Alternately, uninstall any affected software.

A list of possibly affected vendors is given below and will be updated as we learn more.