add zntport.sys

[Element2023H]

Vulnerability Details

The driver utilizes IoCreateDevice to create a device object named \Device\zntport and exposes a corresponding symbolic link at \\.\zntport. This device interface exposes an insecure control code (IOCTL 0xF10024CC) that allows arbitrary physical memory mapping and reading.

Upon receiving IOCTL 0xF10024CC, the driver extracts a 32-bit physical address supplied directly within the user-controlled SystemBuffer without conducting any bounds or permission validation. It then invokes MmMapIoSpace to map 0x32 bytes of physical memory from the provided address into system space using MmNonCached attributes.

The driver subsequently uses strcpy to copy the data from the newly mapped physical memory address back into the SystemBuffer. This transfers the raw physical memory contents directly back to user space before the mapping is released via MmUnmapIoSpace.

Impact & Exploitation

An unprivileged user-mode application can open a handle to the \\.\zntport device interface created via IoCreateDevice. By issuing IOCTL 0xF10024CC with arbitrary physical addresses, a local attacker can leak sensitive kernel structures, credentials, or other critical memory assets, entirely bypassing core operating system security controls.

 case 0xF10024CC:
          pMappingAddress = (char *)MmMapIoSpace((PHYSICAL_ADDRESS)*(unsigned int *)SystemBuffer, 0x32u, MmNonCached);
          strcpy(SystemBuffer, pMappingAddress);
          MmUnmapIoSpace(pMappingAddress, 0x32u);
          v11 = 0x32;
          status = 0;
          break;