| Título | Ultra RAMDisk Kernel Driver URDSCSI.sys 1.82 Local Privilege Escalation |
|---|
| Descrição | Ultra RAMDisk Pro installs a WHQL-signed kernel driver, URDSCSI.sys, that exposes a user-reachable control device at \\.\UltraRAMDiskIOCTL. A standard local user can send IOCTL 0x222B30 with command 0x08 to make the driver call RtlCreateRegistryKey and RtlWriteRegistryValue on caller-selected registry paths and values.
The validation below used a benign test key under HKLM\SOFTWARE\VendorRepro. Direct registry writes by the standard user failed with Access is denied, but the same user wrote a unique marker value through the vendor driver. This proves a local registry DACL bypass from a standard Medium Integrity user.
An unprivileged user can exploit an arbitrary registry value write primitive to achieve local privilege escalation under certain circumstances, such as overwriting service ImagePath or FailureCommand entries to redirect SYSTEM-level execution, injecting malicious paths into COM server registrations, or modifying autorun and Winlogon keys to establish persistent privileged code execution. |
|---|
| Fonte | ⚠️ https://winslow1984.com/books/cve-collection/page/ultra-ramdisk-pro-182-kernel-driver-urdscsisys-local-privilege-escalation-via-arbitrary-registry-value-write |
|---|
| Utilizador | winslow1984 (UID 79140) |
|---|
| Submissão | 20/06/2026 18h39 (há 2 meses) |
|---|
| Moderação | 31/08/2026 06h37 (2 months later) |
|---|
| Estado | Aceite |
|---|
| Entrada VulDB | 397226 [ieungSoft Ultra RAMDisk Pro 1.82 Kernel Driver URDSCSI.sys Elevação de Privilégios] |
|---|
| Pontos | 20 |
|---|