Improper Access Control in EaseUS Partition Master Kernel Driver

Impact Analysis

This vulnerability can impact you by allowing an attacker with local access to bypass proper access controls within the EaseUS Partition Master software. This could lead to unauthorized actions or access to sensitive parts of the system, potentially compromising system integrity, confidentiality, and availability.

Since the exploit has been publicly released, attackers may use it to perform attacks on vulnerable systems that have not been updated.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate step to mitigate this vulnerability is to upgrade the affected component, EaseUS Partition Master, to the latest version where the issue has been resolved.

Useful 0 Not Useful 0

Executive Summary

This vulnerability is a security flaw found in EaseUS Partition Master up to version 14.5. It exists in an unknown function within the EUEDKEPM.sys library, which is part of the Kernel Driver component. The flaw results in improper access controls, meaning that the system does not correctly restrict access to certain functions or data. Exploiting this vulnerability requires local access to the system.

The vendor has confirmed that this issue was only present in older versions of the product and has been resolved in the latest version.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability affects the EaseUS Partition Master software up to version 14.5, specifically an unknown function in the EUEDKEPM.sys kernel driver. Detection involves identifying if the vulnerable version of EaseUS Partition Master is installed on the system.

Since the vulnerability requires local access and involves a kernel driver, network detection is not applicable. Instead, detection should focus on verifying the installed version of EaseUS Partition Master and the presence of the EUEDKEPM.sys driver.

Suggested commands to detect the vulnerable software and driver on a Windows system include:

• Check installed EaseUS Partition Master version via Control Panel or using PowerShell: Get-ItemProperty 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*' | Where-Object { $_.DisplayName -like '*EaseUS Partition Master*' } | Select-Object DisplayName, DisplayVersion
• Search for the EUEDKEPM.sys driver file and check its version: use the command 'dir C:\Windows\System32\drivers\EUEDKEPM.sys /s' or 'Get-Item C:\Windows\System32\drivers\EUEDKEPM.sys | Select-Object VersionInfo'
• Check loaded drivers to see if EUEDKEPM.sys is active: run 'driverquery | findstr EUEDKEPM.sys'

If the installed version is older than the latest patched release (post 14.5), the system is vulnerable and should be updated.

Useful 0 Not Useful 0