| 标题 | Ultra RAMDisk Kernel Driver URDSCSI.sys 1.82 Local Privilege Escalation |
|---|
| 描述 | Ultra RAMDisk Pro installs a WHQL-signed kernel driver, URDSCSI.sys, that exposes a user-reachable control device at \\.\UltraRAMDiskIOCTL. A standard local user can send IOCTL 0x222B30 with command 0x08 to make the driver call RtlCreateRegistryKey and RtlWriteRegistryValue on caller-selected registry paths and values.
The validation below used a benign test key under HKLM\SOFTWARE\VendorRepro. Direct registry writes by the standard user failed with Access is denied, but the same user wrote a unique marker value through the vendor driver. This proves a local registry DACL bypass from a standard Medium Integrity user.
An unprivileged user can exploit an arbitrary registry value write primitive to achieve local privilege escalation under certain circumstances, such as overwriting service ImagePath or FailureCommand entries to redirect SYSTEM-level execution, injecting malicious paths into COM server registrations, or modifying autorun and Winlogon keys to establish persistent privileged code execution. |
|---|
| 来源 | ⚠️ https://winslow1984.com/books/cve-collection/page/ultra-ramdisk-pro-182-kernel-driver-urdscsisys-local-privilege-escalation-via-arbitrary-registry-value-write |
|---|
| 用户 | winslow1984 (UID 79140) |
|---|
| 提交 | 2026-06-20 18時39分 (2 月前) |
|---|
| 管理 | 2026-08-31 06時37分 (2 months later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 397226 [ieungSoft Ultra RAMDisk Pro 1.82 Kernel Driver URDSCSI.sys 权限提升] |
|---|
| 积分 | 20 |
|---|