Description

A security vulnerability has been detected in BioStar VIVID LED DJ 4.0.2411.1500. This affects the function sub_1105C of the file BS_LED64.sys of the component IOCTL Handler. The manipulation of the argument AssociatedIrp leads to write-what-where condition. Local access is required to approach this attack. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-21T02:16:54.037Z",
  "pubdate": "2026-09-21T02:16:54.037Z",
  "executiveSummary": "A critical vulnerability exists in the BioStar VIVID LED DJ 4.0.2411.1500 software, specifically within the BS_LED64.sys kernel driver.\nThe vulnerability is characterized as an arbitrary write-what-where condition arising from improper handling of the AssociatedIrp structure within the driver's IOCTL (Input/Output Control) handler.\nSuccessful exploitation allows a local attacker with sufficient privileges to overwrite arbitrary memory locations, potentially leading to escalation of privileges, kernel-mode code execution, or system instability.\nThis vulnerability requires local access to the affected system, making it a significant concern for environments where untrusted local users have access to hardware control software.\nPublic disclosure of the exploit code increases the risk of exploitation. The vendor has been unresponsive to initial disclosure attempts, leaving systems without an official patch, necessitating immediate administrative intervention to mitigate the risk.",
  "technicalDetails": "The vulnerability resides within the IOCTL handler component of the BS_LED64.sys driver, specifically identified at the function sub_1105C.\nThe root cause is an insecure implementation of memory management during the processing of IOCTL requests. The driver fails to adequately validate or sanitize the AssociatedIrp.SystemBuffer or associated pointers provided within the I/O Request Packet (IRP) structure.\nThe attack flow commences when a user-mode application initiates an IOCTL request to the BS_LED64.sys device object. By manipulating the parameters contained within the IRP, specifically targeting the logic handled by sub_1105C, an attacker can influence the driver to write controlled data to a chosen memory address.\nBecause the driver operates in kernel mode (Ring 0), the lack of bounds checking or validation on the destination address enables the write-what-where primitive. An attacker can use this to overwrite sensitive kernel structures, such as function pointers, process tokens, or System Service Descriptor Table (SSDT) entries.\nThe exploitation process involves: 1. Opening a handle to the vulnerable device object exposed by the driver. 2. Crafting a malicious I/O request packet where the 'what' component contains the payload (e.g., shellcode or bit-flipped configuration) and the 'where' component contains the target kernel memory address. 3. Dispatching the IOCTL request to the driver. 4. Execution of sub_1105C, which performs the unauthorized memory modification due to the trust placed in the user-supplied input.\nPost-exploitation impact typically involves full system compromise. Since the modification occurs within the kernel space, the attacker can effectively bypass User Account Control (UAC), disable security monitoring software, or maintain persistence that survives standard reboots. This is a high-severity flaw given that it provides a direct path from local low-privilege execution to kernel-level control without complex bypasses."
}