| タイトル | Colorful (七彩虹) iGameCenter 2.0.0.82 Incorrect Privilege Assignment |
|---|
| 説明 | # Vulnerability Report: Arbitrary Physical Memory Read/Write in Colorful iGameCenter Driver (BYOVD / Local Privilege Escalation)
## 1. Vulnerability Metadata
- **Vendor:** Colorful (七彩虹)
- **Official Website:** https://www.colorful.cn/
- **Affected Product/Installer:** iGameCenter-x.x.x.x-2026.09.12-Installer_Prod.exe
- **Affected Version:** x.x.x.x
- **Vulnerable Driver Path:** iGameCenter\iGameAPI\Notebook\NotebookSDK\Clevo\ClevoDCHUDriver\AMDRyzenMasterDriver.sys
- **Driver File Version:** x.x.x.x
- **File SHA256:** 4a0d0034f6deabb9369f553d4d9f3a7aa6f87fa8f2292be576d7b42897c686bb
- **Vulnerable Device Name:** `\DosDevices\AMDRyzenMasterDriverV17` (accessible via `\\.\AMDRyzenMasterDriverV17`)
- **Vulnerability Type:** Local Privilege Escalation (EoP) / Bring Your Own Vulnerable Driver (BYOVD)
- **CWE:** CWE-267 (Incorrect Privilege Assignment), CWE-20 (Improper Input Validation)
- **Attack Vector:** Local
- **Privileges Required:** Typically Administrator (due to `IoCreateDeviceSecure` ACL restrictions on recent versions); residual low-privilege scenarios may exist depending on exact SDDL configuration
## 2. Vulnerability Description
The Colorful iGameCenter software drops and loads a vulnerable third-party driver (`AMDRyzenMasterDriver.sys`, version x.x.x.x) during default installation. Although the driver uses `IoCreateDeviceSecure` to create its device object, the dispatch routine fails to implement any meaningful security boundary checks or parameter validation for the exposed I/O Control Codes (IOCTLs).
A local authenticated user who can obtain a handle to the device can supply fully attacker-controlled physical address parameters. The driver then invokes the kernel API `MmMapIoSpace` to map arbitrary physical memory, completely bypassing Windows kernel memory protection mechanisms.
This represents a classic **BYOVD** attack pattern. Although the underlying flaws originate from a third-party AMD component, Colorful ships and deploys this vulnerable version as a built-in dependency, exposing all systems running the software.
## 3. Technical Details
### Reverse Engineering Analysis
The driver’s dispatch routine processes two critical IOCTL codes without validating physical addresses or sizes:
#### 3.1 Arbitrary Physical Memory Read (IOCTL: `0x81112F08`)
Upon receiving control code `0x81112F08`, the driver parses the `SystemBuffer` from user space. Without validating the requested physical address boundaries or size, it passes these parameters directly to `MmMapIoSpace` and copies the mapped memory content back to the user-space output buffer.
#### 3.2 Arbitrary Physical Memory Write (IOCTL: `0x81112F0C`)
Upon receiving control code `0x81112F0C`, the driver parses the target physical address, length, and untrusted data from the `SystemBuffer`. It maps the unvalidated physical address using `MmMapIoSpace` and overwrites the targeted physical memory with attacker-supplied bytes.
### Relevant Decompiled Code (IDA)
```c++
NTSTATUS __fastcall sub_140001A30(PDEVICE_OBJECT DeviceObject, IRP *Irp)
{
...
case 0x81112F08:
v64 = SystemBuffer; // ReadBuffer BY MmMapIoSpace
if ( InputBufferLength >= 0xCuLL
&& OutputBufferLength >= (unsigned __int64)(unsigned int)v64[2] + 12
&& (unsigned __int8)sub_140006134(*(_QWORD *)v64, (unsigned int)v64[2], v64 + 3) )
{
LABEL_352:
v39 = 0;
Irp->IoStatus.Information = OutputBufferLength;
}
break;
default:
...
char __fastcall sub_140006134(PHYSICAL_ADDRESS PhysicalAddress, unsigned int Size, _BYTE *ReadBuffer)
{
char v4; // [rsp+20h] [rbp-28h]
unsigned int i; // [rsp+24h] [rbp-24h]
_BYTE *pMapping; // [rsp+28h] [rbp-20h]
v4 = 0;
pMapping = MmMapIoSpace(PhysicalAddress, Size, MmNonCached);
if ( pMapping )
{
switch ( Size )
{
case 1u:
*ReadBuffer = *pMapping;
break;
case 2u:
*(_WORD *)ReadBuffer = *(_WORD *)pMapping;
break;
case 4u:
*(_DWORD *)ReadBuffer = *(_DWORD *)pMapping;
break;
case 8u:
*(_QWORD *)ReadBuffer = *(_QWORD *)pMapping;
break;
default:
for ( i = 0; i < Size; ++i )
ReadBuffer[i] = pMapping[i];
break;
}
MmUnmapIoSpace(pMapping, Size);
return 1;
}
return v4;
}
...
case 0x81112F0C:
v65 = SystemBuffer; // write buffer by MmMapIoSpace
if ( InputBufferLength >= (unsigned __int64)(unsigned int)SystemBuffer[2] + 12
&& (unsigned __int8)((__int64 (__fastcall *)(_QWORD, _QWORD, int *))sub_140007144)(
*(_QWORD *)v65,
(unsigned int)v65[2],
v65 + 3) )
{
goto LABEL_352;
}
break;
char __fastcall sub_140007144(PHYSICAL_ADDRESS PhysicalAddress, unsigned int Size, __int64 WriteBuffer)
{
char v4; // [rsp+20h] [rbp-28h]
unsigned int i; // [rsp+24h] [rbp-24h]
_BYTE *BaseAddress; // [rsp+28h] [rbp-20h]
v4 = 0;
BaseAddress = MmMapIoSpace(PhysicalAddress, Size, MmNonCached);
if ( BaseAddress )
{
for ( i = 0; i < Size; ++i )
BaseAddress[i] = *(_BYTE *)(WriteBuffer + i);
MmUnmapIoSpace(BaseAddress, Size);
return 1;
}
return v4;
}
...
}
```
## 4. Communication Payload LayoutOffset
0 (8 bytes / QWORD): Target Physical Address
Offset 8 (4 bytes / DWORD): Size (Read/Write Length)
Offset 12: Data Buffer (output for read / input for write)
Buffer Length Constraints:Read (0x81112F08): InputBufferLength >= 12 and OutputBufferLength >= Size + 12
Write (0x81112F0C): InputBufferLength >= Size + 12
## 5. ImpactA
local authenticated user capable of opening a handle to the device can read from and write to arbitrary physical memory addresses. This enables reliable elevation of privileges to SYSTEM (e.g., by modifying process Token structures) and can be used to disable kernel protections such as Driver Signature Enforcement (DSE), load unsigned drivers, or implant rootkits.The vulnerability completely undermines core Windows kernel security boundaries on systems where the vulnerable driver is present.
## 6. Additional Notes
The driver is a known vulnerable component historically associated with AMD Ryzen Master (related to CVE-2020-12928 and subsequent variants listed in LOLDrivers).
Colorful ships this specific version (x.x.x.x) as part of its mainstream product, making it a supply-chain / BYOVD issue.
Recommended remediation: Remove the vulnerable driver, update to a properly secured version, or implement strict physical address validation and access control in the dispatch routines. |
|---|
| ユーザー | Element2023H (UID 99757) |
|---|
| 送信 | 2026年09月16日 15:21 (27 日 ago) |
|---|
| モデレーション | 2026年10月12日 20:53 (26 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 417176 [Colorful iGameCenter 2.0.0.82 Dispatch AMDRyzenMasterDriver.sys MmMapIoSpace SystemBuffer Local Privilege Escalation] |
|---|
| ポイント | 17 |
|---|