When system control software for RGB light shows on Windows computers mutates into a security risk at kernel level, then the digital goat has finally become the gardener. This is exactly what is currently happening at ASUS with its universally pre-installed bloatware “Armoury Crate” – a tool that claims more rights than many administrators should ever have. CVE-2025-3464 is the name of the current super-GAU, discovered by security researcher Marcin “Icewall” Noga from Cisco Talos, and was given a whopping CVSS score of 8.8. The bug is in the driver component AsIO3.sys, a piece of software that digs deep into the kernel – exactly where it really hurts when something goes wrong.
A race condition with an exploit guarantee
The vulnerability is based on a classic time-of-check to time-of-use (ToC-ToU) race condition: The ASUS driver does not check the authorization of an invoked process via Windows’ own security mechanisms such as ACLs or token authentication – no, ASUS prefers to use a self-made check based on a hard-coded SHA-256 checksum (!) of “AsusCertService.exe”. In addition, there is a hand-maintained PID whitelist. This opens the door to manipulation: An attacker creates a hard link from a harmless test app to their own binary, pauses it, replaces the link with the real AsusCertService.exe – and thus fools the driver. The driver dutifully reads the checksum of the now “linked” original, nods through – and grants SYSTEM rights. Full access to memory, I/O ports, model-specific registers (MSRs) and everything that belongs to a kernel. The system is broken before the user even realizes that someone is playing along.
Who is affected? And how bad is it really?
According to ASUS, the vulnerability affects all versions of Armoury Crate between 5.9.9.0 and 6.1.18.0 – in other words, almost every installation for months. Especially bitter: The attacker needs local access. However, this is no consolation, but rather a grim reality. Because in times of phishing, drive-by downloads and social engineering, this step is no longer a hurdle. Cisco reports that the vulnerability was reported to ASUS back in February. There is currently no evidence of exploitation in the wild. But how long this will remain the case is uncertain – after all, kernel exploits of this kind are extremely popular with ransomware actors and state attackers. Who doesn’t want SYSTEM rights at the touch of a button?
And now?
ASUS recommends installing the latest version of Armoury Crate via the app itself:
Settings > Update Center > Check for Updates > Update.
All well and good, but the loss of trust remains. Why it is necessary to equip an RGB controller with kernel rights at all is a question that ASUS should urgently ask itself. Perhaps a look outside the box at Microsoft’s driver security guidelines will help. If you want to be on the safe side, uninstall Armoury Crate completely. Because software that creates security gaps in the kernel just to make a fan curve a little smoother simply has no place on a production system.
ASUS negligent proximity to hardware
The fact that ASUS has increasingly relied on software in recent years is nothing new. But the integration at firmware and driver level is systematic – and risky. Because as soon as marketing departments and RGB fetishists are allowed to have a say in kernel design, abysses like this one arise. Armoury Crate is no longer just an RGB gimmick, but a control center for firmware updates, peripherals and performance management that is deeply integrated into the system. The attack surface is growing exponentially – and with it the risk that a single mistake could lead to a total takeover.
Colorful lights, dark shadows
ASUS has built a ticking time bomb with Armoury Crate. The current exploit is not just a technical error – it is a symptom of a fundamentally flawed security architecture. Anyone who validates kernel drivers with SHA-256 whitelists instead of relying on genuine operating system security is acting negligently – and putting millions of users worldwide at risk. The CVE-2025-3464 case shows that it is not enough for hardware manufacturers to supply software – they also need to understand what they are doing. Otherwise the RGB gimmick will quickly become a gateway for malware, espionage and sabotage.
Source: Bleepingcomputer
37 Antworten
Kommentar
Lade neue Kommentare
Urgestein
Urgestein
Urgestein
Urgestein
Mitglied
Urgestein
Urgestein
Urgestein
Urgestein
Mitglied
Mitglied
Urgestein
Urgestein
Urgestein
Urgestein
Urgestein
Urgestein
Mitglied
Veteran
Alle Kommentare lesen unter igor´sLAB Community →