| 제목 | MOORE THREADS MTT S80 driver package v340.150 Buffer Overflow |
|---|
| 설명 | A critical heap-based buffer overflow flaw was identified within the kernel-mode graphic driver mtdispkm64.sys (SHA256: dad38c813c585d89c27668f42ae537546b00cae1f6b4c8a27d7932fef287211d), bundled with the Moore Threads (MOORE THREADS) MTT S80 driver package v340.150.
Inside DriverEntry, the driver creates a kernel device object at \Device\mtdispkm64. When a local process sends the I/O control code (IOCTL) 0x222404 to the central dispatch routine sub_14000137C, the driver completely fails to enforce any buffer length validation on the user-supplied input or output buffers.
The driver blindly forwards the raw SystemBuffer pointer to the setup initialization routine sub_140001000. Upon execution, sub_140001000 instantly invokes an internal zero-fill primitive to clear a fixed size of 552 bytes (0x228u). If the caller supplies a buffer shorter than 552 bytes, the driver forces an out-of-bounds write, directly corrupting adjacent active memory allocation blocks inside the NonPaged Pool. A local, unprivileged attacker can leverage this unchecked zero-fill primitive to consistently trigger a systemic Kernel Page Fault leading to an immediate Denial of Service (BSOD / DoS), or weaponize it to achieve Local Privilege Escalation (LPE).
Credit:
This vulnerability was discovered and analyzed by ElementXu ([email protected]). |
|---|
| 사용자 | Element2023H (UID 99757) |
|---|
| 제출 | 2026. 07. 18. AM 08:00 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 09. 21. PM 05:38 (2 months later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 408150 [Moore Threads MTT S80 Driver Package 까지 340.150 IOCTL mtdispkm64.sys sub_140001000 메모리 손상] |
|---|
| 포인트들 | 17 |
|---|