| Titolo | MSI Dragon Center <=2.0.155.0 Integer Overflow |
|---|
| Descrizione | An integer overflow vulnerability exists in the MmioWritePath handler within the NTIOLib_MysticLight driver component (NTIOLib_X64.sys) of MSI Dragon Center.
When processing IOCTL 0xC350A108, the driver performs a length validation check by multiplying the user-controlled 'count' and 'elementSize' parameters. However, this multiplication is executed using 32-bit arithmetic without adequate overflow checks. If the product wraps around, the validation check becomes inaccurate and can be bypassed, while the subsequent write loop continues to iterate based on the original, large 'count' value.
Although this execution path is partially gated by an internal state check and a physical-address allowlist, the underlying boundary validation remains flawed, allowing an attacker to trigger unintended behavior in the MMIO write path.
A local attacker with access to the driver's device interface can exploit this vulnerability by sending a specially crafted IOCTL request. The inaccurate length validation can lead to unauthorized or out-of-bounds hardware register access, resulting in device state corruption, system instability, or a Kernel Blue Screen of Death (BSOD).
[PoC Logic]
- Open a handle to \\.\NTIOLib_MysticLight.
- Send IOCTL 0xC350A108 with a valid physicalAddress, elementSize, and an overflowing count parameter.
- Verify the request reaches MmioWritePath via a debugger and observe the system behavior. |
|---|
| Fonte | ⚠️ https://drive.google.com/file/d/10o_-3GOMAvl3tDqQIWYw45rv7MpxYitk/view |
|---|
| Utente | chanhokim (UID 99482) |
|---|
| Sottomissione | 02/07/2026 05:40 (2 mesi fa) |
|---|
| Moderazione | 31/08/2026 12:11 (2 months later) |
|---|
| Stato | Accettato |
|---|
| Voce VulDB | 397288 [MSI Dragon Center fino a 2.0.155.0 MMIO Write Path NTIOLib_X64.sys MmioWritePath count/elementSize buffer overflow] |
|---|
| Punti | 20 |
|---|