DVDFab Virtual Drive dvdfabio.sys LPE via Unchecked Registry IOCTLs

Vulnerability Overview Vulnerability Name: DVDFab Virtual Drive Kernel Driver dvdfabio.sys 1.5.1.0 Local Privilege Escalation Description: The signed kernel driver is included in DVDFab Virtual Drive version 2.0.0.5. This driver exposes and implements registry proxy IOCTLs, allowing callers to create or open arbitrary registry paths from kernel context. The returned registry handle is inserted into the caller's process handle table. Since the driver does not enforce the caller's standard registry access checks when opening keys, a standard user can obtain a usable handle to protect an HKLM key. During the verification phase, a standard user cannot directly write to the protected HKLM test key, nor can they directly query HKLM\SAM\SAM. However, by using the same user context with to open and protect HKLM\SAM\SAM, local privilege escalation is achieved. Impact Scope Affected Product: DVDFab Virtual Drive Test Package: x64 offline installer 2.0.0.5 Driver: dvdfabio.sys Driver Version: 1.5.1.0 Driver SHA-256: C46549359FF81566F5C34359458E3F91C8DB7E3E5BC31680C6ED63A95F38B Remediation Download URL: https://dl.dvdfab.cn/download/284_2005_9042f65d/dvdfab_virtual_drive_x64_2005.exe Filename: dvdfab_virtual_drive_x64_2005.exe Installer SHA-256: 475F1E5A088867840F63148F6CABAB688B8F73F285FEA8F92744C84F1E7 Installer Version: 1.0.0.1 Installer Signature: Valid, DVDFab Software Inc. Installer Signature: Valid, Fengtao Software Inc. Proof of Concept (POC) Code No specific POC code or exploit code was provided in the original document.

Goal Reached Thanks to every supporter — we hit 100%!

DVDFab Virtual Drive dvdfabio.sys LPE via Unchecked Registry IOCTLs