| Título | MOORE THREADS MTT S80 driver package v340.150 Buffer Overflow |
|---|
| Descrição | A critical heap-based buffer overflow flaw was identified within the kernel-mode graphic driver mtdispkm64.sys (SHA256: dad38c813c585d89c27668f42ae537546b00cae1f6b4c8a27d7932fef287211d), bundled with the Moore Threads (MOORE THREADS) MTT S80 driver package v340.150.
Inside DriverEntry, the driver creates a kernel device object at \Device\mtdispkm64. When a local process sends the I/O control code (IOCTL) 0x222404 to the central dispatch routine sub_14000137C, the driver completely fails to enforce any buffer length validation on the user-supplied input or output buffers.
The driver blindly forwards the raw SystemBuffer pointer to the setup initialization routine sub_140001000. Upon execution, sub_140001000 instantly invokes an internal zero-fill primitive to clear a fixed size of 552 bytes (0x228u). If the caller supplies a buffer shorter than 552 bytes, the driver forces an out-of-bounds write, directly corrupting adjacent active memory allocation blocks inside the NonPaged Pool. A local, unprivileged attacker can leverage this unchecked zero-fill primitive to consistently trigger a systemic Kernel Page Fault leading to an immediate Denial of Service (BSOD / DoS), or weaponize it to achieve Local Privilege Escalation (LPE).
Credit:
This vulnerability was discovered and analyzed by ElementXu ([email protected]). |
|---|
| Utilizador | Element2023H (UID 99757) |
|---|
| Submissão | 18/07/2026 08h00 (há 2 meses) |
|---|
| Moderação | 21/09/2026 17h38 (2 months later) |
|---|
| Estado | Aceite |
|---|
| Entrada VulDB | 408150 [Moore Threads MTT S80 Driver Package até 340.150 IOCTL mtdispkm64.sys sub_140001000 Excesso de tampão] |
|---|
| Pontos | 17 |
|---|