HighPublic exploit

Privilege Escalation via .NET DCOM Deserialization in Dolby DAX2/DAX3 API Services

IdentifiersCVE-2017-7293CWE-502· Deserialization of Untrusted Data

CVE-2017-7293 is a privilege escalation vulnerability in the Dolby DAX2 and DAX3 API services, which are implemented as .NET DCOM servers. The vulnerability arises from the exposure of the IManagedObject interface, specifically the GetSerializedBuffer method, which allows arbitrary deserialization of attacker-controlled data using the unsafe .NET BinaryFormatter. This enables a low-privileged user to trigger deserialization in a privileged context, leading to arbitrary code execution with system privileges. The vulnerability affects multiple versions of Dolby Audio X2 (DAX2) and Dolby Audio X3 (DAX3), and has been observed in drivers such as Realtek Audio Driver 6.0.1.7898 on Lenovo P50 systems. The underlying issue is a design flaw in .NET COM interoperability, which is not fully mitigated by Microsoft and affects any .NET DCOM server exposing IManagedObject.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows a local attacker to escalate privileges from a normal user to SYSTEM by sending a crafted serialized object to the vulnerable .NET DCOM service. This can result in full system compromise, including the ability to install malware, exfiltrate data, or further pivot within the environment. The vulnerability can also be exploited remotely in certain DCOM deployment scenarios, leading to remote code execution.

Mitigation

If you can’t patch tonight, do this now.

As a mitigation, restrict access to the vulnerable DCOM services using Windows firewall rules or DCOM configuration to prevent unprivileged users from accessing the service. Remove or disable the affected Dolby drivers and services if they are not required. Monitor for suspicious DCOM activity and privilege escalation attempts. Developers should audit their code for use of .NET DCOM and the BinaryFormatter, and refactor to avoid deserialization of untrusted data.

Remediation

Patch, then assume compromise.

The only effective remediation is to update to a version of the Dolby DAX2/DAX3 API services that has been rewritten in native code or otherwise no longer exposes the vulnerable .NET DCOM interfaces. Microsoft has partially addressed similar issues in other services by rewriting them in native code. Developers should avoid using .NET DCOM for privileged services and never deserialize untrusted data with BinaryFormatter. If possible, uninstall or disable the affected Dolby services and drivers until a fixed version is available.

PUBLIC EXPLOITS

Exploits

No valid public exploits. Mallory filtered out 1 candidate as fakes, detection scripts, or README-only repos.

VALID 0 / 1 TOTALView more in app

All candidate exploits were filtered out by Mallory's validation.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

DolbyDolby Audio X2application

DolbyDolby Audio X3application

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

No public activity tracked yet. Mallory keeps watching.

0 SOURCESView more in app

No public activity observed for this vulnerability.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity

Community discussion across Reddit, Mastodon, and other social sources.

EXTERNAL REFERENCES

MITRE CVE

cve.org · CVE-2017-7293

NVD

nvd.nist.gov/vuln/detail/CVE-2017-7293

MITRE CWE · CWE-502

Deserialization of Untrusted Data

Third Party Advisory

bugs.chromium.org/p/project-zero/issues/detail?id=1075

Third Party Advisory

exploit-db.com/exploits/41933

Privilege Escalation via .NET DCOM Deserialization in Dolby DAX2/DAX3 API Services

IdentifiersCVE-2017-7293CWE-502· Deserialization of Untrusted Data