| शीर्षक | MSI Dragon Center <=2.0.155.0 Integer Overflow |
|---|
| विवरण | An integer overflow vulnerability exists in the MmioWritePath handler within the NTIOLib_MysticLight driver component (NTIOLib_X64.sys) of MSI Dragon Center.
When processing IOCTL 0xC350A108, the driver performs a length validation check by multiplying the user-controlled 'count' and 'elementSize' parameters. However, this multiplication is executed using 32-bit arithmetic without adequate overflow checks. If the product wraps around, the validation check becomes inaccurate and can be bypassed, while the subsequent write loop continues to iterate based on the original, large 'count' value.
Although this execution path is partially gated by an internal state check and a physical-address allowlist, the underlying boundary validation remains flawed, allowing an attacker to trigger unintended behavior in the MMIO write path.
A local attacker with access to the driver's device interface can exploit this vulnerability by sending a specially crafted IOCTL request. The inaccurate length validation can lead to unauthorized or out-of-bounds hardware register access, resulting in device state corruption, system instability, or a Kernel Blue Screen of Death (BSOD).
[PoC Logic]
- Open a handle to \\.\NTIOLib_MysticLight.
- Send IOCTL 0xC350A108 with a valid physicalAddress, elementSize, and an overflowing count parameter.
- Verify the request reaches MmioWritePath via a debugger and observe the system behavior. |
|---|
| स्रोत | ⚠️ https://drive.google.com/file/d/10o_-3GOMAvl3tDqQIWYw45rv7MpxYitk/view |
|---|
| उपयोगकर्ता | chanhokim (UID 99482) |
|---|
| सबमिशन | 02/07/2026 05:40 AM (2 महीनों पहले) |
|---|
| संयम | 31/08/2026 12:11 PM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 397288 [MSI Dragon Center तक 2.0.155.0 MMIO Write Path NTIOLib_X64.sys MmioWritePath count/elementSize बफ़र ओवरफ़्लो] |
|---|
| अंक | 20 |
|---|