| Título | Kingston FURY CTRL 2.0.66.0 Exposed IOCTL with Insufficient Access Control |
|---|
| Descripción | Title:Kingston FURY CTRL x.x.x.x - NTIOLib_X64.sys Arbitrary I/O Port Read/Write (Insufficient Access Control / Incomplete Blocklist)
Vendor:Kingston
Product:FURY CTRL (RGB Control Software)
Affected Version:x.x.x.x (and possibly earlier)
Vulnerable Component:NTIOLib_X64.sys (device object \\.\NTIOLib_KSFX)
Driver SHA256:cfb4ddc14dc5bd2639eaeb32f3994ccbb7c4fa2c9a5f1b861aceef1aceccb9a4
Download URL:https://media.kingston.com.cn/kingston/support/downloads/FURYCTRL_Installer_2.0.66.0.zip
CWE:
- CWE-782: Exposed IOCTL with Insufficient Access Control
- CWE-266: Incorrect Privilege Assignment
Vulnerability Type:Local Privilege Escalation / Denial of Service / Information Disclosure (BYOVD)
Description:
A local security boundary bypass vulnerability exists in the kernel driver NTIOLib_X64.sys shipped with Kingston FURY CTRL version 2.0.66.0.
Although the driver creates its device object with IoCreateDeviceSecure and implements a magic-number handshake (0x2F405A34 via IOCTL 0xC350214C), the core I/O port communication routines lack proper range validation and access control.
After a successful handshake, any process running with administrative privileges can issue specific IOCTLs to execute arbitrary Ring-0 in/out instructions on almost any critical hardware I/O port. This creates a severe BYOVD (Bring Your Own Vulnerable Driver) surface, allowing attackers to subvert Windows kernel protections (e.g., Driver Signature Enforcement, PPL).
Technical Details:
1. Arbitrary I/O Port Read
Handler function (approx. sub_14000137C):
- IOCTL 0xC35060CC → __inbyte(port)
- IOCTL 0xC35060D0 → __inword(port)
- IOCTL 0xC35060D4 → __indword(port)
The port number is taken directly from the user-supplied InputBuffer without any range restriction.
2. Arbitrary I/O Port Write (Incomplete Blocklist)
Handler function (approx. sub_1400017EC):
- IOCTL 0xC350A0D8 → __outbyte(port, value)
- IOCTL 0xC350A0DC → __outword(port, value)
- IOCTL 0xC350A0E0 → __outdword(port, value)
The driver only blocks three ports: 0xCF9, 0x64, and 0x61.
All other critical ports (including PCI configuration ports 0xCF8/0xCFC, ACPI registers, Super I/O, etc.) remain fully accessible.
Root Cause Analysis (IDA):
```c++
__int64 __fastcall sub_14000137C(
int IoControlCode,
int *InputBuffer,
int InputBufferLength,
_BYTE *OutBuffer,
int OutBufferLength,
_DWORD *a6)
{
int v6; // eax
unsigned __int32 v8; // eax
unsigned __int16 v9; // ax
unsigned __int8 v10; // al
if ( dword_140004210 != 0x2F405A34 )
return 0xC0000008LL;
v6 = *InputBuffer;
if ( InputBufferLength != 2 )
return 0xC0000008LL;
switch ( IoControlCode )
{
case 0xC35060CC:
v10 = __inbyte(v6);
*OutBuffer = v10;
break;
case 0xC35060D0:
v9 = __inword(v6);
*(_WORD *)OutBuffer = v9;
break;
case 0xC35060D4:
v8 = __indword(v6);
*(_DWORD *)OutBuffer = v8;
break;
default:
*a6 = 0;
return 0xC0000008LL;
}
*a6 = 2;
return 0;
}
NTSTATUS __fastcall sub_1400017EC(int IoControlCode, int *InputBuffer)
{
int v3; // edx
if ( dword_140004210 == 0x2F405A34 )
{
v3 = *InputBuffer;
if ( v3 != 0xCF9 && v3 != 0x64 && v3 != 0x61 )
{
switch ( IoControlCode )
{
case 0xC350A0D8:
__outbyte(v3, *((_BYTE *)InputBuffer + 4));
return 0;
case 0xC350A0DC:
__outword(v3, *((_WORD *)InputBuffer + 2));
return 0;
case 0xC350A0E0:
__outdword(v3, InputBuffer[1]);
return 0;
}
}
}
return STATUS_INVALID_HANDLE;
}
```
Impact:
- BYOVD: The driver is legitimately signed and can be loaded on modern Windows 10/11 systems with DSE enabled.
- Local Denial of Service (BSOD) by writing to sensitive ports.
- Information disclosure via arbitrary port reads.
- Potential Local Privilege Escalation primitive when combined with chipset-specific configurations (e.g., PCI config space manipulation).
Distinction from existing CVE-2026-19381:
CVE-2026-19381 (Kingston FURY CTRL x.x.x.x / NTIOLib_KSFX.sys) appears to focus on MSR read/write functionality.
The vulnerability described in this report is a separate issue involving different IOCTL handlers that allow arbitrary I/O port (in/out) access with an incomplete blocklist. It affects version x.x.x.x and should be considered an independent vulnerability.
|
|---|
| Usuario | Element2023H (UID 99757) |
|---|
| Sumisión | 2026-10-19 12:32 (hace 25 días) |
|---|
| Moderación | 2026-11-13 21:04 (25 days later) |
|---|
| Estado | Aceptado |
|---|
| Entrada de VulDB | 437302 [Kingston FURY CTRL RGB Control Software hasta 2.0.66.0 IOCTL NTIOLib_X64.sys Local Privilege Escalation] |
|---|
| Puntos | 17 |
|---|