| 标题 | Wincor Nixdorf Wincor Nixdorf PORT IO Driver <=1.0.0.1 Buffer Overflow |
|---|
| 描述 | The Wincor Nixdorf PORT IO Driver 'wnport.sys' contains 4 vulnerable IOCTL codes: 0x80102040, 0x80102044, 0x80102050, and 0x80102054. These flaws arise due to insufficient input validation within the IOCTL_DEVICEIO_CONTROL_FUNCTION subroutine at sub_11100. Specifically, the driver fails to properly check the length of the input buffer against the internal buffer size limit, allowing an attacker to send a buffer that exceeds the allocated stack space.
Exploiting these vulnerable IOCTLs can have severe consequences. By sending a large input buffer via DeviceIoControl, an attacker can trigger a stack overflow condition. This not only causes the system to crash with a PAGE_FAULT_NON_PAGE blue screen error but also leads to memory corruption. In more dangerous scenarios, the memory corruption can be exploited to achieve arbitrary code execution. Since the driver's IOCTL functions can be called by low-privileged programs, attackers don't need high-level access to start the exploitation process. Once arbitrary code execution is achieved, attackers can run unauthorized commands with elevated privileges, potentially stealing sensitive data, installing malware, or taking full control of the affected system. |
|---|
| 来源 | ⚠️ https://b.iakb.org/2025/06/26/Wincor-Nixdorf-PORT-IO-Driver-Buffer-Overflow/ |
|---|
| 用户 | rickqwq (UID 87143) |
|---|
| 提交 | 2025-06-27 01時38分 (1 年前) |
|---|
| 管理 | 2025-10-18 09時49分 (4 months later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 329013 [Nixdorf Wincor PORT I/O Driver 直到 1.0.0.1 IOCTL wnport.sys sub_11100 内存损坏] |
|---|
| 积分 | 20 |
|---|