| タイトル | AOMEI AOMEI Dynamic Disk Manager Kernel Driver ddmdrv.sys 10.10.1 Local Privilege Escapation |
|---|
| 説明 | ddmdrv.sys, shipped with AOMEI Partition Assistant Standard 10.10.1, exposes the \\.\ddmwrt device to a standard local user and forwards raw read/write requests to the underlying disk stack. The forwarded requests are issued by the kernel driver, so the standard Windows access check that prevents a non-administrator from opening \\.\PhysicalDriveN is bypassed.
In a controlled proof, a standard Medium Integrity user could not open a temporary VHD-backed physical disk directly. The same user then wrote a unique 512-byte marker to that disk through \\.\ddmwrt\Partition0\DISK1, read it back through the driver, and an Administrator confirmed the marker by directly reading \\.\PhysicalDrive1 at the same offset.
An unprivileged user can exploit arbitrary read/write primitives over protected file resources to achieve local privilege escalation. |
|---|
| ソース | ⚠️ https://winslow1984.com/books/cve-collection/page/aomei-dynamic-disk-manager-10101-kernel-driver-ddmdrvsys-local-privilege-escalation |
|---|
| ユーザー | winslow1984 (UID 79140) |
|---|
| 送信 | 2026年05月22日 07:32 (4 月 ago) |
|---|
| モデレーション | 2026年06月20日 11:36 (29 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 372520 [AOMEI Dynamic Disk Manager 迄 10.10.1 Kernel Driver ddmdrv.sys 特権昇格] |
|---|
| ポイント | 20 |
|---|