| Titel | MOORE THREADS MTT S80 driver package v340.150 Buffer Overflow |
|---|
| Beschreibung | A critical heap-based buffer overflow flaw was identified within the kernel-mode graphic driver mtdispkm64.sys (SHA256: dad38c813c585d89c27668f42ae537546b00cae1f6b4c8a27d7932fef287211d), bundled with the Moore Threads (MOORE THREADS) MTT S80 driver package v340.150.
Inside DriverEntry, the driver creates a kernel device object at \Device\mtdispkm64. When a local process sends the I/O control code (IOCTL) 0x222404 to the central dispatch routine sub_14000137C, the driver completely fails to enforce any buffer length validation on the user-supplied input or output buffers.
The driver blindly forwards the raw SystemBuffer pointer to the setup initialization routine sub_140001000. Upon execution, sub_140001000 instantly invokes an internal zero-fill primitive to clear a fixed size of 552 bytes (0x228u). If the caller supplies a buffer shorter than 552 bytes, the driver forces an out-of-bounds write, directly corrupting adjacent active memory allocation blocks inside the NonPaged Pool. A local, unprivileged attacker can leverage this unchecked zero-fill primitive to consistently trigger a systemic Kernel Page Fault leading to an immediate Denial of Service (BSOD / DoS), or weaponize it to achieve Local Privilege Escalation (LPE).
Credit:
This vulnerability was discovered and analyzed by ElementXu ([email protected]). |
|---|
| Benutzer | Element2023H (UID 99757) |
|---|
| Einreichung | 18.07.2026 08:00 (vor 2 Monaten) |
|---|
| Moderieren | 21.09.2026 17:38 (2 months later) |
|---|
| Status | Akzeptiert |
|---|
| VulDB Eintrag | 408150 [Moore Threads MTT S80 Driver Package bis 340.150 IOCTL mtdispkm64.sys sub_140001000 Pufferüberlauf] |
|---|
| Punkte | 17 |
|---|