| 제목 | IObit IObit Unlocker 1.3.0.12 Improper Privilege Management |
|---|
| 설명 | Vulnerability Timeline & Prior Proposal Notice:
- Baseline Telemetry Logged: July 9, 2026 (via Tracker ID CAN-2026-2033463)
The discoverer previously logged a preliminary tracker under ID CAN-2026-2033463 to establish baseline telemetry. This VulDB submission represents the formal technical escalation and active CVE assignment request by the original exclusive author (ElementXu) to transition this critical exposure into an actively managed CVE.
Summary:
An incomplete fix and security bypass issue was discovered in the driver "IObitUnlocker.sys" (v1.3.0.20, SHA256: c6e50ac7b540e20979b9928867bacf738fab41e0543b0587cd8c0fe90273a577) bundled with IObit Unlocker v1.3.0.12. The underlying architectural flaw permits arbitrary process destruction via a trusted kernel conduit.
Technical Analysis & Exploit Primitives:
The vendor previously attempted to remediate this interface by implementing IoCreateDeviceSecure with an explicit SDDL string of D:P(A;;GA;;;SY)(A;;GA;;;BA) to restrict device object access (\Device\IObitUnlockerDevice exposed via symlink \\.\IObitUnlockerDevice) strictly to SYSTEM and Administrators.
However, the IRP_MJ_DEVICE_CONTROL dispatch routine still exposes a dangerous and deeply flawed capability via IOCTL code 0x222124. This specific IOCTL accepts a target executable file path string within the input buffer (rather than a typical Process ID). The driver then resolves the corresponding active process in the kernel context and directly invokes ZwTerminateProcess from kernel-mode (Ring 0). Crucially, the routine performs zero validation regarding the target process's Windows Protected Process Light (PPL) level relative to the caller's true privileges.
Impact & Security Boundary Bypass:
Because the termination sequence originates natively within Ring 0, it completely bypasses the operating system's user-mode object access constraints and active PPL safeguards. Any authenticated attacker who has already obtained standard administrative privileges can abuse this validly signed IObit driver as an immediate Bring Your Own Vulnerable Driver (BYOVD) weapon. This flaw allows malicious payloads to arbitrarily neutralize core endpoint defense software (EDR/AV agents) and vital system protection processes, resulting in full system compromise and anti-tamper deactivation.
Credit:
This vulnerability was discovered and analyzed by ElementXu ([email protected]).
|
|---|
| 사용자 | Element2023H (UID 99757) |
|---|
| 제출 | 2026. 07. 17. AM 09:36 (1 월 ago) |
|---|
| 모더레이션 | 2026. 08. 30. PM 05:19 (1 month later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 397170 [IObit Unlocker 1.3.0.12 IRP_MJ_DEVICE_CONTROL IObitUnlocker.sys ZwTerminateProcess 권한 상승] |
|---|
| 포인트들 | 17 |
|---|