| タイトル | MOORE THREADS MTT S80 driver package v340.150 Buffer Overflow |
|---|
| 説明 | A critical heap-based buffer overflow flaw was identified within the kernel-mode graphic driver mtdispkm64.sys (SHA256: dad38c813c585d89c27668f42ae537546b00cae1f6b4c8a27d7932fef287211d), bundled with the Moore Threads (MOORE THREADS) MTT S80 driver package v340.150.
Inside DriverEntry, the driver creates a kernel device object at \Device\mtdispkm64. When a local process sends the I/O control code (IOCTL) 0x222404 to the central dispatch routine sub_14000137C, the driver completely fails to enforce any buffer length validation on the user-supplied input or output buffers.
The driver blindly forwards the raw SystemBuffer pointer to the setup initialization routine sub_140001000. Upon execution, sub_140001000 instantly invokes an internal zero-fill primitive to clear a fixed size of 552 bytes (0x228u). If the caller supplies a buffer shorter than 552 bytes, the driver forces an out-of-bounds write, directly corrupting adjacent active memory allocation blocks inside the NonPaged Pool. A local, unprivileged attacker can leverage this unchecked zero-fill primitive to consistently trigger a systemic Kernel Page Fault leading to an immediate Denial of Service (BSOD / DoS), or weaponize it to achieve Local Privilege Escalation (LPE).
Credit:
This vulnerability was discovered and analyzed by ElementXu ([email protected]). |
|---|
| ユーザー | Element2023H (UID 99757) |
|---|
| 送信 | 2026年07月18日 08:00 (2 月 ago) |
|---|
| モデレーション | 2026年09月21日 17:38 (2 months later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 408150 [Moore Threads MTT S80 Driver Package 迄 340.150 IOCTL mtdispkm64.sys sub_140001000 メモリ破損] |
|---|
| ポイント | 17 |
|---|