Description

ASRock Polychrome SYNC/RGB software utility developed by ASRock Inc. has an Improper Access Control vulnerability. Authenticated local attackers can send a specially crafted IOCTL request to cause the driver to write to improperly restricted I/O ports, resulting in a forced operating system reboot.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-09-14T11:17:07.643Z",
  "pubdate": "2026-09-14T11:17:07.643Z",
  "executiveSummary": "ASRock Polychrome SYNC/RGB software utility is susceptible to an Improper Access Control vulnerability residing within its kernel-mode driver. This flaw allows an authenticated local attacker to send malformed IOCTL (Input/Output Control) requests to the driver, which subsequently fails to perform adequate input validation. By leveraging this oversight, a malicious actor can trigger unauthorized write operations to restricted I/O ports. Successful exploitation results in a forced system reboot, leading to a localized Denial of Service (DoS). The vulnerability necessitates local system access and authentication, but does not require administrative privileges to initiate the IOCTL request, presenting a risk to system availability and stability for multi-user environments or systems running untrusted software.",
  "technicalDetails": "The vulnerability originates from a lack of secure communication boundaries between the user-mode application and the kernel-mode driver associated with ASRock Polychrome SYNC/RGB software. The driver exposes an IOCTL interface designed for controlling hardware-specific lighting components; however, the dispatch routine fails to properly validate the memory buffer or the target I/O port address supplied in the request.\nExploitation follows a specific attack flow: First, an authenticated attacker initiates an application process capable of communicating with the device driver via the CreateFile API. Once a handle to the device is acquired, the attacker crafts a malicious payload encapsulated within an IOCTL request. This payload is passed to the DeviceIoControl function, targeting the vulnerable driver interface.\nUpon receiving the request, the driver fails to restrict access to sensitive I/O ports. Instead of enforcing bounds checking, the driver proceeds to execute an out-of-band write operation. By specifying an improper I/O port address, the attacker can force the hardware to enter an undefined or unstable state. In many architectures, writing arbitrary data to specific chipset or motherboard control registers causes an immediate kernel panic or hardware-triggered machine check exception, manifesting as a forced operating system reboot.\nThe root cause is identified as an insufficient validation of user-supplied data within the driver's I/O request packet (IRP) handling logic. Because the driver operates at kernel privilege (Ring 0), it bypasses standard hardware protections that would normally prevent user-mode processes from directly interacting with I/O ports. The impact is essentially a privilege escalation of the interaction, where a low-privileged user can force a system-wide reset. This vulnerability is restricted to local exploitation, meaning the attacker must already possess the ability to execute code on the host system to interact with the device handle. No network exposure is required for the exploit to succeed, as the attack surface is strictly limited to the local Windows kernel-mode device interface."
}