Sunia SPB Driver LPE via Arbitrary Physical Memory Read/Write (CVE-2026-XXXX)

Vulnerability Overview CVE-2026-XXXX: Sunia SPB Peripheral Driver LPE Vulnerability Title: Sunia SPB Peripheral Driver - Arbitrary Physical Memory Read/Write Leading to Local Privilege Escalation Publication Date: 2026-01-20 Vulnerability Researcher: b3s3da Vendor: Sunia Electronics Driver Version: 1.0.7.2 (TcnPeripheral64.sys) SHA256: fa4e294b11e613a27722559b043837bd48af5603ab7e8c7978caff996cf7247 Test Environment: Windows 10 x64 (21H2), Windows 11 x64 (24H2) Vulnerability Type: Local Privilege Escalation (LPE) via Arbitrary Physical Memory Read/Write Impact Scope Affected Driver: TcnPeripheral64.sys Symbolic Link: Vulnerable IOCTL: 0x4002048 (Decimal: 67119176) Vulnerable Function: Subroutine at offset 0x2088 Driver Hash (SHA256): fa4e294b11e613a27722559b043837bd48af5603ab7e8c7978caff996cf7247 Remediation Current Status: No patch has been released. Vulnerability Description The driver (provided with certain Lenovo devices) contains a critical vulnerability in its IOCTL handler that allows unprivileged user-mode applications to map arbitrary physical memory with read/write permissions ( ). The vulnerability resides in the dispatch routine for IOCTL . The driver accepts user-supplied physical addresses and sizes, passing them directly to / backed by without any validation of the requested address range or the caller's privileges. Low-privilege code execution can leverage this vulnerability to achieve full local privilege escalation to : 1. Scan physical memory to locate the kernel structure. 2. Identify the System process (PID 4) and the attacker's process. 3. Overwrite the attacker's process token with the System process token. 4. Spawn a child process inheriting SYSTEM privileges. Technical Details Root Cause The IOCTL handler calls in (physical read) and (physical write) using user-controlled and parameters without any boundary checks: The following checks are missing: Physical address range (allowing mapping of kernel memory, structures, page tables). Caller's privilege level (any user can send the IOCTL). Size of the mapping request. Proof of Concept (POC) Hardware Initialization Bypass (BYOVD Context) The driver includes a Hardware Init check ( ) that verifies the presence of specific ACPI resources (GPIO/Interrupts) before enabling the IOCTL interface. On standard systems without Sunia hardware, the driver fails to initialize and returns error 1 ( ). Exploitation Technique: To exploit this vulnerability on arbitrary targets (Bring Your Own Vulnerable Driver scenario), the driver must be manually bound to legacy system resources. This is achieved by forcing the driver to attach to an existing system device, thereby bypassing the initialization check. Conceptual Proof of Concept (PoC) The PoC ( ) demonstrates full LPE from an unprivileged user to : 1. Open the driver via the symbolic link. 2. Dynamically resolve offsets exported from ( , , ) to avoid hardcoded offsets and ensure cross-Windows version compatibility. 3. Enumerate physical memory ranges via the Superfetch API ( class 79). 4. Scan physical memory for structures, validating (kernel pointers) and by matching . 5. Copy the System process token into the exploit's . 6. Spawn running as . Driver Installation (Bypass Setup) Since the target machine may lack specific Sunia hardware, the driver is installed using the "Legacy Hardware" method: 1. Open Device Manager ( ). 2. Select Action > Add legacy hardware. 3. Select "Install the hardware that I manually select from a list (Advanced)". 4. Select System devices > Next. 5. Click "Have Disk..." and browse to . 6. Select "Sunia SPB Peripheral Driver" and complete the installation. This binds the driver to generic system resources, satisfying the internal hardware initialization check. Screenshots Arbitrary Physical Memory Read/Write: Local Privilege Escalation — Token Theft to NT AUTHORITY\SYSTEM: !Local Privilege Escalation Impact Disclaimer This research is for educational purposes and authorized security testing only. The author is not responsible for any unauthorized use of this information. Unauthorized access to computer systems is illegal.

Goal Reached Thanks to every supporter — we hit 100%!

Sunia SPB Driver LPE via Arbitrary Physical Memory Read/Write (CVE-2026-XXXX)

More from this source