| Título | Colorful (七彩虹) iGameCenter 2.0.0.81 Improper Privilege Management |
|---|
| Descrição | Credit:
This vulnerability was discovered and analyzed by ElementXu([email protected])
Colorful iGameCenter version x.x.x.x (installer: iGameCenter-x.x.x.x-2026.07.03-Installer_Prod.exe) suffers from Improper Privilege Management.
The bundled kernel driver component WinRing0x64.sys creates a device symbolic link \\.\WinRing0_1_2_0 via IoCreateDevice without restrictive access control lists (ACLs).
This flaw allows low-privileged local users to open handles to the device. By sending specific IOCTL codes (including 0x9C406104 for physical memory reading via MmMapIoSpace, and 0x9C402084/0x9C402088 for MSR registers reading/writing), a local attacker can exploit this Bring Your Own Vulnerable Driver (BYOVD) behavior to execute arbitrary code with kernel privileges and achieve Local Privilege Escalation (LPE).
Technical Analysis & Disassembly:
1. Arbitrary Physical Memory Read (IOCTL: 0x9C406104)
The dispatch routine sub_110D8 processes IOCTL 0x9C406104 by calling sub_11504, which takes a user-supplied structure to map physical memory using MmMapIoSpace and copy data back to user space without proper privilege checks or comprehensive boundary validation.
Input Request Data Structure:
typedef struct _INPUT_BUFFER_READ
{
PVOID PhysicalAddress;
ULONG AlignNumer;
ULONG AlignSize;
} INPUT_BUFFER_READ, *PINPUT_BUFFER_READ;
v11 = sub_11504( // 0x9C406104 Read
(PINPUT_BUFFER_READ)Irp->AssociatedIrp.SystemBuffer,
CurrentStackLocation->Parameters.DeviceIoControl.InputBufferLength,
Irp->AssociatedIrp.SystemBuffer,
CurrentStackLocation->Parameters.DeviceIoControl.OutputBufferLength,
p_Information);
NTSTATUS __fastcall sub_11504(
PINPUT_BUFFER_READ InputReq,
int InputBufferLength,
void *OutputBuffer,
unsigned int OutbufferLength,
unsigned int *a5)
{
__int64 v8; // rax
__int64 PhysicalAddress; // rcx
SIZE_T v10; // rbp
PVOID pMappingAddress; // rax
char v12; // r12
__int64 v13; // rcx
_DWORD *v14; // rdi
_DWORD *v15; // rsi
__int64 AlignSize; // rcx
_WORD *v17; // rdi
_WORD *v18; // rsi
if ( InputBufferLength != 16 )
return STATUS_INVALID_PARAMETER;
v8 = InputReq->AlignNumer * InputReq->AlignSize;
if ( OutbufferLength < (unsigned int)v8 )
return STATUS_INVALID_PARAMETER;
PhysicalAddress = (__int64)InputReq->PhysicalAddress;
if ( PhysicalAddress < 786432 )
return STATUS_INVALID_PARAMETER;
v10 = (unsigned int)v8;
if ( PhysicalAddress + v8 - 1 > 0xFFFFF )
return STATUS_INVALID_PARAMETER;
pMappingAddress = MmMapIoSpace((PHYSICAL_ADDRESS)PhysicalAddress, (unsigned int)v8, MmNonCached);
v12 = 0;
switch ( InputReq->AlignNumer )
{
case 1u:
qmemcpy(OutputBuffer, pMappingAddress, InputReq->AlignSize);
break;
case 2u:
AlignSize = InputReq->AlignSize;
v17 = OutputBuffer;
v18 = pMappingAddress;
while ( AlignSize )
{
*v17++ = *v18++;
--AlignSize;
}
break;
case 4u:
v13 = InputReq->AlignSize;
v14 = OutputBuffer;
v15 = pMappingAddress;
while ( v13 )
{
*v14++ = *v15++;
--v13;
}
break;
default:
v12 = 1;
break;
}
MmUnmapIoSpace(pMappingAddress, v10);
if ( v12 )
return STATUS_INVALID_PARAMETER;
*a5 = OutbufferLength;
return 0;
}
2. Arbitrary MSR Read (IOCTL: 0x9C402084)
The driver exposes direct access to read Model Specific Registers (MSR) using the __readmsr instruction based on user input.
case 0x9C402084:
v11 = sub_11468(
(unsigned int *)Irp->AssociatedIrp.SystemBuffer,
CurrentStackLocation->Parameters.DeviceIoControl.InputBufferLength,
(unsigned __int64 *)Irp->AssociatedIrp.SystemBuffer,
CurrentStackLocation->Parameters.DeviceIoControl.OutputBufferLength,
p_Information);
Disassembly of sub_11468:
__int64 __fastcall sub_11468(unsigned int *a1, __int64 a2, unsigned __int64 *a3, __int64 a4, _DWORD *a5)
{
unsigned __int64 v5;
v5 = __readmsr(*a1);
*a3 = ((unsigned __int64)HIDWORD(v5) << 32) | (unsigned int)v5;
*a5 = 8;
return 0;
}
3. Arbitrary MSR Write (IOCTL: 0x9C402088)
The driver exposes direct access to write to MSR registers using the __writemsr instruction. Attackers can overwrite critical registers such as IA32_LSTAR (0xC0000082) to hijack system call entry points and execute shellcode with ring 0 privileges.
Disassembly of sub_1149C:
__int64 __fastcall sub_1149C(__int64 a1, __int64 a2, __int64 a3, __int64 a4, _DWORD *a5)
{
__writemsr(*(_DWORD *)a1, *(_QWORD *)(a1 + 4));
*a5 = 0;
return 0;
} |
|---|
| Utilizador | Element2023H (UID 99757) |
|---|
| Submissão | 17/07/2026 05h57 (há 1 mês) |
|---|
| Moderação | 30/08/2026 11h59 (1 month later) |
|---|
| Estado | Aceite |
|---|
| Entrada VulDB | 397126 [Colorful iGameCenter 2.0.0.81 IOCTL Dispatch WinRing0x64.sys sub_11504 PhysicalAddress/AlignNumer/AlignSize Elevação de Privilégios] |
|---|
| Pontos | 17 |
|---|