Description

A vulnerability was detected in BioStar VALKYRIE AURORA 2.10.2411.0800. This vulnerability affects the function sub_1105C of the file BS_RVSIO64.sys of the component IOCTL Handler. The manipulation of the argument PhysicalAddress results in write-what-where condition. The attack needs to be approached locally. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-21T02:16:54.213Z",
  "pubdate": "2026-09-21T02:16:54.213Z",
  "executiveSummary": "A critical memory corruption vulnerability has been identified in the BioStar VALKYRIE AURORA driver, BS_RVSIO64.sys, version 2.10.2411.0800. The flaw manifests as an arbitrary write-what-where primitive within the IOCTL handler, specifically impacting the sub_1105C function.\nThis vulnerability allows a local, authenticated attacker to bypass system memory protections by manipulating the PhysicalAddress argument passed to the vulnerable IOCTL handler. The resulting write-what-where condition provides the capability to modify kernel-mode memory, potentially leading to privilege escalation, arbitrary code execution, or complete system compromise.\nGiven that the exploit is public and the vendor remains unresponsive, the risk to affected systems is classified as high. Successful exploitation requires local access, but because the vulnerability resides in a driver, it can be triggered by low-privileged users if the device interface permissions are not strictly hardened. The lack of vendor patching necessitates immediate manual intervention to protect system integrity.",
  "technicalDetails": "The vulnerability resides within the BS_RVSIO64.sys kernel driver, specifically within the IOCTL dispatch logic handled by sub_1105C. The root cause is an inadequate validation of user-supplied input when processing specific IOCTL requests that involve direct memory access or physical memory mapping.\nThe function sub_1105C accepts a structure from user-space that includes a field designated as PhysicalAddress. The driver fails to perform sufficient bounds checking or validation to ensure that this address points to legitimate, non-critical memory regions. Because the driver performs a write operation to this user-controlled address without verification, it effectively grants the caller a write-what-where primitive.\nAttack flow involves the following steps: First, an attacker obtains a handle to the vulnerable device object exposed by the BS_RVSIO64.sys driver. Second, the attacker allocates or identifies a target memory region in kernel space that facilitates privilege escalation, such as modifying the token of the current process or overwriting function pointers in the kernel dispatch tables. Third, the attacker invokes the DeviceIoControl API with the specific IOCTL code associated with sub_1105C, providing a crafted buffer where the PhysicalAddress field is populated with the targeted kernel memory address and the data to be written.\nUpon receiving the request, the driver fails to validate the scope of the physical address, proceeding to write the user-provided data directly to the specified memory location. This allows for the manipulation of kernel structures. The impact is significant: by overwriting critical kernel objects, an attacker can transition from a low-privileged user to NT AUTHORITY\\SYSTEM. This level of access permits the installation of rootkits, disabling of security software (such as EDR or AV), and total control over the underlying operating system. Because this is a kernel-mode vulnerability, exploitation is not constrained by traditional user-mode DEP or ASLR protections, as the kernel operates within a high-privileged execution context. There is no requirement for network exposure, as the attack is strictly local in nature, yet the severity is amplified by the ability to bypass kernel-mode security enforcement."
}