| 标题 | MSI Dragon Center <=2.0.155.0 Integer Overflow |
|---|
| 描述 | An integer overflow vulnerability exists in the MmioWritePath handler within the NTIOLib_MysticLight driver component (NTIOLib_X64.sys) of MSI Dragon Center.
When processing IOCTL 0xC350A108, the driver performs a length validation check by multiplying the user-controlled 'count' and 'elementSize' parameters. However, this multiplication is executed using 32-bit arithmetic without adequate overflow checks. If the product wraps around, the validation check becomes inaccurate and can be bypassed, while the subsequent write loop continues to iterate based on the original, large 'count' value.
Although this execution path is partially gated by an internal state check and a physical-address allowlist, the underlying boundary validation remains flawed, allowing an attacker to trigger unintended behavior in the MMIO write path.
A local attacker with access to the driver's device interface can exploit this vulnerability by sending a specially crafted IOCTL request. The inaccurate length validation can lead to unauthorized or out-of-bounds hardware register access, resulting in device state corruption, system instability, or a Kernel Blue Screen of Death (BSOD).
[PoC Logic]
- Open a handle to \\.\NTIOLib_MysticLight.
- Send IOCTL 0xC350A108 with a valid physicalAddress, elementSize, and an overflowing count parameter.
- Verify the request reaches MmioWritePath via a debugger and observe the system behavior. |
|---|
| 来源 | ⚠️ https://drive.google.com/file/d/10o_-3GOMAvl3tDqQIWYw45rv7MpxYitk/view |
|---|
| 用户 | chanhokim (UID 99482) |
|---|
| 提交 | 2026-07-02 05時40分 (2 月前) |
|---|
| 管理 | 2026-08-31 12時11分 (2 months later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 397288 [MSI Dragon Center 直到 2.0.155.0 MMIO Write Path NTIOLib_X64.sys MmioWritePath count/elementSize 内存损坏] |
|---|
| 积分 | 20 |
|---|