| Título | CoolerMaster MASTERPLUS+ 1.9.6 Incorrect Default Permissions |
|---|
| Descripción | Vendor:CoolerMaster
Website:https://www.coolermaster.com.cn/
Product:MASTERPLUS+
Latest Version:1.9.6
Download URL:https://www.coolermaster.com.cn/DriveDownload/Software/MasterPlus/Installer_MasterPlus_v1.9.6.zip
Vulnerable Component Driver:CoolerMaster\MasterPlus\WinRing0x64.sys(version:x.x.x.x)
sha256:11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5
Vulnerability Type:
CWE-1244:Internal Asset Exposed to Unsafe IOCTL in Kernel Mode
CWE-276:Incorrect Default Permissions
Description:
The driver creates the device object `\\.\WinRing0_1_2_0` using `IoCreateDevice` without implementing any access control or permission checks on the requesting process. Any local user (including low-privileged users) can open a handle to this device and issue DeviceIoControl requests.
The driver exposes the IOCTL code `0x9C406104`, which implements an arbitrary physical memory read primitive. The handler (`sub_11504`) accepts a 16-byte input structure and maps the specified physical address range via `MmMapIoSpace` (MmNonCached), then copies the data back to user mode. Although a limited address-range check is performed (PhysicalAddress ≥ 0xC0000 and PhysicalAddress + size − 1 ≤ 0xFFFFF), this restriction is insufficient to prevent exploitation.
An attacker can leverage this unrestricted physical memory read capability to:
- Escalate privileges from a low-privileged user to SYSTEM
- Dump sensitive process memory (e.g., LSASS) to extract credentials
- Perform further kernel memory manipulation leading to full system compromise
Impact:
Local Privilege Escalation (LPE) to SYSTEM and credential dumping.
Root Cause Analysis (IDA)
```c++
NTSTATUS __fastcall sub_110D8(PDEVICE_OBJECT DeviceObject, IRP *Irp)
{
...
// 0x9C406104
v11 = sub_11504(
Irp->AssociatedIrp.SystemBuffer,
CurrentStackLocation->Parameters.DeviceIoControl.InputBufferLength,
Irp->AssociatedIrp.SystemBuffer,
CurrentStackLocation->Parameters.DeviceIoControl.OutputBufferLength,
(__int64)p_Information);
...
}
// Input Request Data Structure
// typedef struct _INPUT_BUFFER_READ
// {
// PVOID PhysicalAddress;
// ULONG AlignNumer;
// ULONG AlignSize;
// } INPUT_BUFFER_READ, *PINPUT_BUFFER_READ;
NTSTATUS __fastcall sub_11504(
PINPUT_BUFFER_READ InputBuffer,
int InputBufferLength,
void *OutBuffer,
unsigned int OutBufferLength,
unsigned int *a5)
{
__int64 v8; // rax
__int64 PhysicalAddress; // rcx
SIZE_T v10; // rbp
PVOID pMapping; // rax
char v12; // r12
__int64 v13; // rcx
_DWORD *v14; // rdi
_DWORD *v15; // rsi
__int64 AlignSize; // rcx
_WORD *v17; // rdi
_WORD *v18; // rsi
if ( InputBufferLength != 16 )
return STATUS_INVALID_PARAMETER;
v8 = InputBuffer->AlignNumer * InputBuffer->AlignSize;
if ( OutBufferLength < (unsigned int)v8 )
return STATUS_INVALID_PARAMETER;
PhysicalAddress = (__int64)InputBuffer->PhysicalAddress;
if ( PhysicalAddress < 786432 )
return STATUS_INVALID_PARAMETER;
v10 = (unsigned int)v8;
if ( PhysicalAddress + v8 - 1 > 0xFFFFF )
return STATUS_INVALID_PARAMETER;
pMapping = MmMapIoSpace((PHYSICAL_ADDRESS)PhysicalAddress, (unsigned int)v8, MmNonCached);
v12 = 0;
switch ( InputBuffer->AlignNumer )
{
case 1u:
qmemcpy(OutBuffer, pMapping, InputBuffer->AlignSize);
break;
case 2u:
AlignSize = InputBuffer->AlignSize;
v17 = OutBuffer;
v18 = pMapping;
while ( AlignSize )
{
*v17++ = *v18++;
--AlignSize;
}
break;
case 4u:
v13 = InputBuffer->AlignSize;
v14 = OutBuffer;
v15 = pMapping;
while ( v13 )
{
*v14++ = *v15++;
--v13;
}
break;
default:
v12 = 1;
break;
}
MmUnmapIoSpace(pMapping, v10);
if ( v12 )
return STATUS_INVALID_PARAMETER;
*a5 = OutBufferLength;
return 0;
}
``` |
|---|
| Usuario | Element2023H (UID 99757) |
|---|
| Sumisión | 2026-10-19 09:07 (hace 26 días) |
|---|
| Moderación | 2026-11-13 20:42 (26 days later) |
|---|
| Estado | Aceptado |
|---|
| Entrada de VulDB | 437286 [CoolerMaster MASTERPLUS+ 1.9.6 Device Driver WinRing0x64.sys sub_11504 PhysicalAddress escalada de privilegios] |
|---|
| Puntos | 17 |
|---|