| Título | MOORE THREADS MTT S80 driver package v340.150 Incorrect Use of Privileged APIs |
|---|
| Descripción | A critical structural flaw leading to Local Privilege Escalation (LPE) via an unvalidated functional execution chain was identified within the kernel-mode graphic driver mtdispkm64.sys (SHA256: dad38c813c585d89c27668f42ae537546b00cae1f6b4c8a27d7932fef287211d), bundled with the Moore Threads (MOORE THREADS) MTT S80 driver package v340.150.
After a local process leverages IOCTL 0x222404 to retrieve an internal vtable array comprising 7 raw kernel function pointers, it can weaponize IOCTL 0x222408 to orchestrate a deterministic cross-boundary control-flow execution chain that resolves straight into a high-privilege mapping sink:
1.Context Tampering: A local unprivileged user invokes the 7th exported routine sub_14000C7A8 from user-space to overwrite active metadata control blocks at offsets 0x6278 through 0x62E0 within the global kernel context structure, injecting an arbitrary target physical address and a desired mapping size.
2.Chained Triggering: The attacker then invokes the 1st exported routine sub_14000C4E0 from user-mode. This routine accepts the manipulated object base (v5) without validation, extracts parameters into a kernel buffer, and triggers a deep nested indirect call via v9 = *(_QWORD *)(v5 + 128) + 160LL.
3.The Ultimate Execution Sink: Due to a complete absence of privilege-token checking or state verification, the execution flow redirects directly into the unexported kernel function sub_140006F0C.
4.Arbitrary Physical Mapping: Inside sub_140006F0C, the driver directly fetches the uncontrolled physical address from object offset a1[41] (328 bytes) and length from Size[2], feeding them straight into privileged kernel operations including MmMapIoSpace, IoAllocateMdl, and MmBuildMdlForNonPagedPool.
By allowing user-mode components to abuse the leaked functional dispatcher to steer kernel control flow back into official privileged sinks, this vulnerability enables local attackers to map and rewrite core system physical memory pages (such as PML4/PDPT page table entries or process CR3 directory bases), fully bypassing Windows kernel protection schemes (HVCI/DSE) to achieve Local Privilege Escalation (LPE).
Credit:This vulnerability was discovered and analyzed by ElementXu ([email protected]). |
|---|
| Usuario | Element2023H (UID 99757) |
|---|
| Sumisión | 2026-07-18 08:11 (hace 2 meses) |
|---|
| Moderación | 2026-09-21 17:38 (2 months later) |
|---|
| Estado | Aceptado |
|---|
| Entrada de VulDB | 408151 [Moore Threads MTT S80 Driver Package 340.150 IOCTL mtdispkm64.sys sub_140006F0C escalada de privilegios] |
|---|
| Puntos | 17 |
|---|