提交 #864536: PowerISO PowerISO 9.3.0.0 Kernel Driver 6.9.0.0 Local Privilege Escalation

PowerISO 9.3 installs the signed kernel driver scdemu.sys. When loaded, the driver creates user-visible virtual CD device links such as \\.\SCDEmuDev0. Two registry helper IOCTLs are reachable from a standard user:

0x80002018: writes or deletes a caller-selected registry value through RtlWriteRegistryValue.
0x8000201C: opens and deletes a caller-selected empty registry key.
The driver performs these operations from kernel context without enforcing the caller's normal registry permissions. In the validation below, a standard user could not directly write or delete protected HKLM objects, but could write a protected HKLM value and delete a protected empty HKLM key through \\.\SCDEmuDev0.

An unprivileged user can exploit combined arbitrary registry write and deletion primitives to achieve local privilege escalation under certain circumstances, such as atomically replacing service ImagePath or FailureCommand values, deterministically hijacking COM server registrations with attacker-controlled DLL paths, or tampering with LSA policy and autorun keys to trigger SYSTEM code execution — offering higher reliability and reduced detection surface compared to deletion-only primitives.

• 来源: ⚠️ https://winslow1984.com/books/cve-collection/page/poweriso-9300-kernel-driver-6900-local-privilege-escalation-via-arbitrary-registry-write-or-deletion
• 用户: winslow1984 (UID 79140)
• 提交: 2026-06-20 18時38分 (2 月前)
• 管理: 2026-08-06 21時56分 (2 months later)
• 状态: 已接受
• VulDB条目: 386707 [Power Sofware PowerISO 9.3.0.0 Kernel Driver scdemu.sys 权限提升]
• 积分: 20