| タイトル | IObit IObit Unlocker 1.3.0.12 Improper Privilege Management |
|---|
| 説明 | Vulnerability Timeline & Prior Proposal Notice:
- Baseline Telemetry Logged: July 9, 2026 (via Tracker ID CAN-2026-2033463)
The discoverer previously logged a preliminary tracker under ID CAN-2026-2033463 to establish baseline telemetry. This VulDB submission represents the formal technical escalation and active CVE assignment request by the original exclusive author (ElementXu) to transition this critical exposure into an actively managed CVE.
Summary:
An incomplete fix and security bypass issue was discovered in the driver "IObitUnlocker.sys" (v1.3.0.20, SHA256: c6e50ac7b540e20979b9928867bacf738fab41e0543b0587cd8c0fe90273a577) bundled with IObit Unlocker v1.3.0.12. The underlying architectural flaw permits arbitrary process destruction via a trusted kernel conduit.
Technical Analysis & Exploit Primitives:
The vendor previously attempted to remediate this interface by implementing IoCreateDeviceSecure with an explicit SDDL string of D:P(A;;GA;;;SY)(A;;GA;;;BA) to restrict device object access (\Device\IObitUnlockerDevice exposed via symlink \\.\IObitUnlockerDevice) strictly to SYSTEM and Administrators.
However, the IRP_MJ_DEVICE_CONTROL dispatch routine still exposes a dangerous and deeply flawed capability via IOCTL code 0x222124. This specific IOCTL accepts a target executable file path string within the input buffer (rather than a typical Process ID). The driver then resolves the corresponding active process in the kernel context and directly invokes ZwTerminateProcess from kernel-mode (Ring 0). Crucially, the routine performs zero validation regarding the target process's Windows Protected Process Light (PPL) level relative to the caller's true privileges.
Impact & Security Boundary Bypass:
Because the termination sequence originates natively within Ring 0, it completely bypasses the operating system's user-mode object access constraints and active PPL safeguards. Any authenticated attacker who has already obtained standard administrative privileges can abuse this validly signed IObit driver as an immediate Bring Your Own Vulnerable Driver (BYOVD) weapon. This flaw allows malicious payloads to arbitrarily neutralize core endpoint defense software (EDR/AV agents) and vital system protection processes, resulting in full system compromise and anti-tamper deactivation.
Credit:
This vulnerability was discovered and analyzed by ElementXu ([email protected]).
|
|---|
| ユーザー | Element2023H (UID 99757) |
|---|
| 送信 | 2026年07月17日 09:36 (1 月 ago) |
|---|
| モデレーション | 2026年08月30日 17:19 (1 month later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 397170 [IObit Unlocker 1.3.0.12 IRP_MJ_DEVICE_CONTROL IObitUnlocker.sys ZwTerminateProcess 特権昇格] |
|---|
| ポイント | 17 |
|---|