CVE-2022-47631

Summary

CVE-2022-47631 is a privilege escalation vulnerability affecting Razer Synapse versions up to 3.7.1209.121307. The issue arises from an unsafe installation path and insufficient privilege management of the Razer driver installer. Malicious actors can exploit this vulnerability by placing malicious DLLs into %PROGRAMDATA%\Razer\Synapse3\Service\bin before the service installation and denying write access for the SYSTEM user. Although the service will not start if it detects malicious DLLs in this directory, attackers can leverage a race condition to replace a legitimate Razer DLL with a malicious one after the service has already checked the file. Consequently, local Windows users can exploit this condition to gain administrative privileges.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.