| タイトル | Ultra RAMDisk Kernel Driver URDSCSI.sys 1.82 Local Privilege Escalation |
|---|
| 説明 | Ultra RAMDisk Pro installs a WHQL-signed kernel driver, URDSCSI.sys, that exposes a user-reachable control device at \\.\UltraRAMDiskIOCTL. A standard local user can send IOCTL 0x222B30 with command 0x08 to make the driver call RtlCreateRegistryKey and RtlWriteRegistryValue on caller-selected registry paths and values.
The validation below used a benign test key under HKLM\SOFTWARE\VendorRepro. Direct registry writes by the standard user failed with Access is denied, but the same user wrote a unique marker value through the vendor driver. This proves a local registry DACL bypass from a standard Medium Integrity user.
An unprivileged user can exploit an arbitrary registry value write primitive to achieve local privilege escalation under certain circumstances, such as overwriting service ImagePath or FailureCommand entries to redirect SYSTEM-level execution, injecting malicious paths into COM server registrations, or modifying autorun and Winlogon keys to establish persistent privileged code execution. |
|---|
| ソース | ⚠️ https://winslow1984.com/books/cve-collection/page/ultra-ramdisk-pro-182-kernel-driver-urdscsisys-local-privilege-escalation-via-arbitrary-registry-value-write |
|---|
| ユーザー | winslow1984 (UID 79140) |
|---|
| 送信 | 2026年06月20日 18:39 (2 月 ago) |
|---|
| モデレーション | 2026年08月31日 06:37 (2 months later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 397226 [ieungSoft Ultra RAMDisk Pro 1.82 Kernel Driver URDSCSI.sys 特権昇格] |
|---|
| ポイント | 20 |
|---|