CYBELSOFT DriversCloud_amd64.sys exposes 7 IOCTLs with no access checks and a zero security descriptor on the device object, meaning any user (including low-integrity processes) can open a handle. Primitives include arbitrary physical memory read via MmMapIoSpace (up to 2MB per call), arbitrary MSR read/write (including IA32_LSTAR for instant kernel code execution), arbitrary I/O port read/write, and arbitrary PCI configuration space read/write. A full LSTAR hijack PoC with crash-safe ROP res...
sc.exe create DriversCloud_amd64 binPath=C:\windows\temp\DriversCloud_amd64.sys type=kernel && sc.exe start DriversCloud_amd64sc.exe create DriversCloud_amd64 binPath=C:\windows\temp\DriversCloud_amd64.sys type=kernel && sc.exe start DriversCloud_amd64Sandbox: execFile · Timeout: 30s
security.privilegeescalation.kernel-exploit examples:
CYBELSOFT DriversCloud_amd64.sys exposes 7 IOCTLs with no access checks and a zero security descriptor on the device object, meaning any user (including low-integrity processes) can open a handle. Primitives include arbitrary physical memory read via MmMapIoSpace (up to 2MB per call), arbitrary MSR read/write (including IA32_LSTAR for instant kernel code execution), arbitrary I/O port read/write, and arbitrary PCI configuration space read/write. A full LSTAR hijack PoC with crash-safe ROP restore has been demonstrated. The developer acknowledged the issue and is working on a rewritten driver.
Use Case: Elevate privileges
Required Privileges: kernel
MITRE ATT&CK: T1068